IRL - Auto Trash Deletion Plugin

[noelsaw1]

🔴 SECURITY RED FLAGS

1. HIGH: Missing Nonce Validation in AJAX Handler
   Location: class-ncr-batch-delete.php:1841-1887

Issue: The handle_ajax_get_log() AJAX endpoint lacks CSRF protection.

public function handle_ajax_get_log(): void {
// Check permissions
if ( ! current_user_can( 'manage_options' ) ) {
wp_send_json_error( [ 'message' => 'Permission denied' ], 403 );
}
// ❌ MISSING: Nonce validation here
Vulnerability: A logged-in admin could be tricked into making requests to this endpoint via CSRF attack.

Impact: While this endpoint only reads data (low impact), it violates WordPress security best practices and could leak job status information.

Fix Required: Add nonce validation like the other handler:

if ( ! check_ajax_referer( 'ncr_activity_log_nonce', 'nonce', false ) ) {
wp_send_json_error( [ 'message' => 'Invalid nonce' ], 403 );
}
⚠️ PERFORMANCE CONCERNS

1. Query Without Index Usage
   Location: class-ncr-batch-delete.php:1240-1248

Issue: The deletion query filters on post_type and post_status, then orders by ID. On a 270k+ row table, this may not use optimal indexes.

SELECT ID FROM {$wpdb->posts}
WHERE post_type = %s
AND post_status = 'trash'
ORDER BY ID ASC
LIMIT %d
Recommendation: Verify index exists:

SHOW INDEX FROM wp_posts WHERE Key_name LIKE '%type%' OR Key_name LIKE '%status%';
Impact: Medium - Could slow down batch queries on very large databases.