DB ACF Extension WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB-

Medium-severity findings.

Audited release

1.8.0

Findings

3

Worst severity

medium

Content hash

3858b5c9d0a3137186792e34… Copy

Findings

• medium Hardcoded CF7 healthcheck email bypasses spam checks and drops notification mail

  predictable_token

  Any visitor, authenticated or not, can submit a public Contact Form 7 form with any posted field set exactly to monitoring+cf7test@digitalebazen.nl (the default of db_cf7_healthcheck/test_email). is_healthcheck_submission() treats that marker as the plugin's own probe. skip_spam_check() then returns true, so CF7's wpcf7_skip_spam_check consumer skips Akismet and the rest of the spam pipeline. maybe_skip_mail() returns true whenever the db_cf7_mail_form_id transient is empty, so wpcf7_skip_mail drops the notification email while CF7 still reports success. skip_flamingo() returns an empty array, so Flamingo's wpcf7_flamingo_submit_if consumer does not store the message. Other wpcf7_before_send_mail listeners still receive the rest of the submitted fields, so a CRM or webhook integration still fires with no owner email and no Flamingo record. During the daily run, that transient names one form for about five minutes; for that form maybe_skip_mail() allows mail and redirect_mail() rewrites the mail recipient to wordpress@digitalebazen.nl, sending the submission to the plugin vendor instead of the site.

  classes/cf7-healthcheck.php:99-101,460-524

  Recommendation

  Authenticate healthcheck submissions with a per-run secret stored in a short-lived transient and submitted only by the loopback request. Honor the spam, mail, Flamingo, and recipient hooks only when that secret matches. Do not treat a publicly known email address as the capability check.

• low Manual CF7 healthcheck runs from a GET request with no nonce

  missing_nonce

  maybe_run_manually() on init calls run_manual_test() for any non-empty ?db_cf7_test=1, and admin_post_db_cf7_test calls the same method. The handler checks current_user_can('manage_options') and then deletes the db_cf7_running lock, submits every testable Contact Form 7 form, and sends the summary mail. There is no nonce or referer check. A logged-in administrator who follows either link runs that job. With the default SameSite=Lax auth cookie this is a top-level navigation, not a silent cross-site image request. The posted field values are the plugin's own test payload, not attacker input, but every testable form is still submitted and wpcf7_before_send_mail listeners still run.

  classes/cf7-healthcheck.php:50-56,105-136

  Recommendation

  Remove the front-end query trigger. On admin-post, require a manage_options nonce with check_admin_referer before deleting the lock or calling run().

• low Nightly CF7 summary is emailed to a hardcoded third-party mailbox

  information_disclosure

  recipient() defaults to wordpress@digitalebazen.nl unless the site filters db_cf7_healthcheck/recipient. send_summary_mail() runs from the public cron hook db_cf7_daily_healthcheck and from the manual admin run, and wp_mail()s that address a body listing every published form title and ID plus, on failure, up to 300 characters of the contact-form-7 feedback response. Installing the plugin is enough; the site owner does not opt in. The default test payload is not credentials, but the form inventory and endpoint error text leave the site for a mailbox the owner does not control.

  classes/cf7-healthcheck.php:95-97,531-563

  Recommendation

  Default the recipient to the site admin email, or send nothing until a site explicitly sets db_cf7_healthcheck/recipient. Do not ship response-body snippets to a third party by default.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.