Ian Dunn · Report #185914
constant cache_page_secret in regolith
How it was found
in: https://github.com/iandunn/regolith/blob/master/config/plugins/wp-super-cache.php#L28
$cache_page_secret = 'ad270361c39c428c9465313363b02559';
there usage of static $cache_page_secret, as regolith is installation template. it's better to generate the secret for each installation instead of using static known value. knowledge of $cache_page_secret value can be used to send requests which will not pass though the caching: https://github.com/Automattic/wp-super-cache/blob/ea592c1d2796d0bc5c343322923c5f8bb40a0066/wp-cache-phase1.php#L32 thus enable more effective DOS (denial of service) attacks as the caching mechanism is disabled.
fix: generate the $cache_page_secret in safe way once per installation & store the value in needed configuration file.