WP Github Push WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.1

Findings

2

Worst severity

high

Content hash

723a6774334708f6a9d75108… Copy

Findings

• high Unauthenticated-to-Subscriber AJAX clear logs with path control

  missing_auth

  github_sync_clear_logs_ajax reads $_POST[plugin_dir_path] without sanitize path constraints, capability, or nonce, then file_put_contents($path . "github-sync.log", ""). Any logged-in user can truncate github-sync.log under a path they supply (filesystem write wherever the web user can write that filename).

  wp-github-push.php:56-61

  Recommendation

  Require manage_options + check_ajax_referer; hardcode plugin_dir_path(__FILE__) instead of trusting POST.

• medium Settings save lacks CSRF nonce and stores GitHub PAT in options

  csrf

  github_sync_settings() calls github_sync_save_settings() on POST without check_admin_referer/current_user_can inside the save function. An admin CSRF can change monitored directory, repo, and github_token (stored via update_option).

  includes/settings.php:31-114

  Recommendation

  Add capability check + nonce; store the PAT encrypted or in a non-autoloaded option and never echo it back in the form value attribute in full.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.