Skip to content
This repository was archived by the owner on Aug 8, 2026. It is now read-only.

WP Sudo v2.10.0 — Research Snapshot

Pre-release
Pre-release

Choose a tag to compare

View all tags
@dknauss dknauss released this 01 Mar 04:01
· 1103 commits to main since this release
v2.10.0
197afa9

Versions before 4.9.0 automatically replayed an intercepted request after reauthentication (#322). Do not use this version.

RESEARCH PROTOTYPE ONLY. Do not install on production, public staging, or any site containing real users, credentials, or data. Use only in WordPress Playground or a disposable local test environment.

What's New

WebAuthn Gating Bridge

New bridge plugin (bridges/wp-sudo-webauthn-bridge.php) gates WebAuthn security key registration and deletion behind WP Sudo's reauthentication. Without this bridge, an attacker with a hijacked session could silently register their own security key for persistent access — the same risk class as ungated Application Password creation.

  • Gates webauthn_preregister, webauthn_register, and webauthn_delete_key AJAX actions
  • Class-existence guard: rules only injected when Two Factor Provider for WebAuthn is active
  • Drop into wp-content/mu-plugins/ to activate
  • 6 unit tests, 29 assertions

WP 7.0 Notice CSS Fix

REST error notices in the Application Passwords section (profile.php) now have a visible light red background in WordPress 7.0+, where core removed .notice-error backgrounds. Scoped to #application-passwords-section — doesn't affect other admin notices.

CI Integration Test Fixes

Fixed 4 failing integration tests in ExitPathTest.php:

  • Challenge constructor was called with wrong argument order
  • simulate_admin_request() now calls set_current_screen() so is_admin() returns true in CI
  • Grace window pass test was passing vacuously; now tests real gate logic

Documentation

  • Developer reference: new "Gating Third-Party Plugin Actions" section with worked AJAX example
  • Two Factor integration: WebAuthn bridge reference
  • Manual testing: §20 WebAuthn bridge tests (5 steps)
  • Contributing: bridge plugin table and creation guide, Playground limitations for WebAuthn
  • ROADMAP: notice CSS marked fixed, WebAuthn challenge UX documented

Stats

  • 411 unit tests, 1,008 assertions
  • PHPStan level 6 — zero errors
  • 14 files changed, +496 −7

Full Changelog: v2.9.2...v2.10.0

Assets 2
Loading