T09 · Insecure Skill Coding Practices
- Location
scripts/wp-cli.js:61- Finding
WordPress Credentials May Be Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
scripts/wp-cli.js:61-67, 91
Vulnerability Type: Missing HTTPS enforcement for authenticated requests
Risk Level: HighVulnerable Code
js function resolveBaseUrl() { const base = process.env.WP_BASE_URL; if (!base) { console.error('Missing WP_BASE_URL. Example: https://example.com'); process.exit(1); } return base.replace(/\/$/, ''); }js const response = await fetch(buildApiUrl(path, query), options);Authentication headers are constructed from reusable credentials before the request:
js function buildAuthHeader() { const basicToken = process.env.WP_BASIC_TOKEN; if (basicToken) { return { Authorization: `Basic ${basicToken}` }; } const user = process.env.WP_USER; const appPassword = process.env.WP_APP_PASSWORD; if (user && appPassword) { const token = Buffer.from(`${user}:${appPassword}`).toString('base64'); return { Authorization: `Basic ${token}` }; } const jwt = process.env.WP_JWT_TOKEN; if (jwt) { return { Authorization: `Bearer ${jwt}` }; } return {}; }Technical Analysis
WP_BASE_URLis accepted without validating its URL scheme. The request code attaches anAuthorizationheader containing either a Basic authentication token, a Base64-encoded username and application password, or a JWT bearer token. It then sends the request to the configured URL usingfetch().Base64 encoding does not encrypt Basic authentication credentials. If
WP_BASE_URLuseshttp:, credentials, JSON request bodies, and server responses may be visible to network-positioned attackers. Documentation recommends HTTPS, but a documentation-only recommendation does not prevent insecure runtime configuration. The Skill description inSKILL.mdalso refers to “plain HTTP,” increasing the risk of unsafe interpretation.Sending credentials to the operator-con ...[truncated 1765 chars]
- Remediation
View remediation
Remediation Suggestions
-
Parse and validate
WP_BASE_URLbefore constructing requests:js function resolveBaseUrl() { const configured = process.env.WP_BASE_URL; if (!configured) { throw new Error('Missing WP_BASE_URL. Example: https://example.com'); } const url = new URL(configured); if (url.protocol !== 'https:') { throw new Error('WP_BASE_URL must use HTTPS.'); } url.pathname = url.pathname.replace(/\/+$/, ''); return url.toString().replace(/\/$/, ''); } -
Reject all schemes other than
https:. If plaintext HTTP is required for local development, require an explicit opt-in and restrict it to loopback hosts such as127.0.0.1,::1, orlocalhost. -
Do not silently follow cross-origin redirects while retaining authentication. Implement explicit redirect handling and ensure credentials are never forwarded to a different origin.
-
Update
SKILL.mdto replace “using plain HTTP” with wording that clearly requires HTTPS for authenticated remote connections. -
Continue recommending dedicated, minimally privileged WordPress accounts and short-lived or readily revocable credentials.
-
Add automated tests confirming that
http://remote URLs and non-HTTP schemes are rejected before authentication headers are transmitted.
-