Email Registration Blocker WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.4.6

Findings

1

Worst severity

medium

Content hash

398edd1e8622785e55ca680d… Copy

Findings

• medium Unauthenticated unbounded autoloaded block log enables site-wide DoS

  dos

  Every blocked registration calls is_blocked($email) with $log=true (registration_errors, rest_pre_insert_user, and pre_user_email). log_blocked_email() get_option('wilcosky_erb_block_log'), appends {email,time}, and update_option()s the whole array. The 100-entry cap is opt-in: register_setting('wilcosky_erb_max_log_limit') defaults to false, and get_option($this->opt_log_limit, false) keeps it off. update_option() is called without autoload=false, so the first insert autoloads. On sites with registration open and any domain/email blocked (manual, CSV, or the predefined list), an unauthenticated client can POST unique blocked addresses (e.g. rand@blocked.example) and grow an autoloaded wp_options row without rate limit. Each attempt rereads and rewrites the entire blob (quadratic). Consumers are every request via alloptions plus the manage_options settings page, which array_column/array_count_values the full log. Plugin Requires at least: 5.0, so many installs lack later core autoload-size safeguards. Email values are is_email-constrained on the default register_new_user path and echoed with esc_html in admin, so this is availability not XSS.

  wilcosky-email-blocker.php:410-423

  Recommendation

  Always cap wilcosky_erb_block_log (ignore the opt-in flag, or default wilcosky_erb_max_log_limit to true) and pass autoload=false / 'no' on update_option/add_option. Prefer a non-autoloaded custom table or a rotating transient. Do not log on every public pre_user_email hit without a size/rate limit. Add current_user_can('manage_options') next to the nonce in handle_clear_logs as defense in depth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.