🔥 QuizWizz v1.10.0 — Audit & Roast
Historical record — 2026-07-24
Preserved as observed. Current truth: Program Masterplan.
TL;DR
Verdict:
vendor/is a war crime, the actual code is honor-roll. Sins are architectural taste (static mega-classes, dead shims, PHP-8.3 elitism, a PDF monolith on a quiz toy) — not competence. Zero classic WP security holes found. Grade: A- code / C packaging.
- subject: QuizWizz — build/publish/print/play validated MCQ + true-false quizzes
- version: 1.10.0
- bench: https://wrdp.loca.zone (isolated Docker WP 7.0 + MariaDB 11.4)
- method: source read (
includes/), footgun grep, dependency x-ray. No dynamic exploit run. - scope_read:
quizwizz.php,Rest/GenerateController,Rest/QuizController,Rest/SettingsController,Ai/OpenRouterClient,Ai/AiBudget,RateLimiter,QuizAccess,AttemptService,Frontend/Shortcode,Plugin
🗺️ Verdict Map
flowchart LR QW["QuizWizz 1.10.0"] --> SEC["🛡️ Security"] QW --> ARCH["🏛️ Architecture"] QW --> PKG["📦 Packaging"] SEC --> S1["✅ prepare() everywhere"] SEC --> S2["✅ sanitize + validate input"] SEC --> S3["✅ token/cap gates + rate limit"] SEC --> S4["✅ SSRF-bounded AI + cost ledger"] ARCH --> A1["⚠️ 680-line static controller"] ARCH --> A2["⚠️ dead compat shims"] ARCH --> A3["⚠️ hard-wired PdfGenerator"] PKG --> P1["❌ full mPDF vendor tree"] PKG --> P2["❌ PHP 8.3 floor"] PKG --> P3["❌ Tested up to 7.0 only"]
📊 Scorecard
| Dimension | Grade | One-line |
|---|---|---|
| 🛡️ Security | A | prepared SQL, sanitized input, token+cap gates, SSRF-bounded egress |
| 🧮 AI cost governance | A+ | pre-flight micro-budget ledger, price caps, ZDR/deny defaults |
| 🧱 Input validation | A | schema-validated, size-capped bodies, strict multipart allowlist |
| 🏛️ Architecture | C+ | static mega-classes, no DI, untestable hot paths |
| 📦 Packaging / footprint | D | ~138k LOC, mostly bundled PDF engine + fonts |
| 🌍 Compat / reach | C | PHP 8.3 min excludes much of shared hosting |
| 📚 Docs / provenance | A- | readme, BUILDING, SOURCE-PROVENANCE, THIRD-PARTY notices present |
✅ What it gets right (verified)
| 🏅 Strength | Evidence |
|---|---|
| All SQL parameterized | AiBudget.php:66-90,154-267,340-375; RateLimiter.php:128-142; AttemptService.php:97-101 — every call via $wpdb->prepare(), dynamic IN() builds %s placeholders |
| Input sanitized + regex-validated | RateLimiter::client_key rejects non-^[a-f0-9]{64}$ (:16-39); every $_GET/$_COOKIE wp_unslash+sanitize_* |
| Public routes gated in depth | GenerateController.php:98-105 __return_true then rate-limit + current_user_can('edit_post') (:84,645); mutations manage_options/EDIT_QUIZZES |
| Guest access = hashed expiring tokens | QuizAccess.php:11-24 sha256 + hash_equals; cookie httponly+samesite=Lax+secure-on-ssl (:32-43) |
| SSRF-bounded AI egress | OpenRouterClient.php:115-129 wp_safe_remote_post, redirection=0, limit_response_size, req/resp byte caps (:15-16,108,160) |
| Pre-flight AI cost ledger | OpenRouterClient.php:70-78 reserve→settle/release; max_price caps + data_collection:deny+zdr (:80-89) |
| API key never persisted/echoed | OpenRouterClient.php:18-27 env-first then constant; never options table |
| Transactional rate limiter | RateLimiter.php:77-108 real START TRANSACTION/COMMIT/ROLLBACK, multi-bucket (session/account/network/global) |
| Disciplined resource cleanup | GenerateController.php:610-616 try/finally deletes temp logo + PDF artifacts |
Footgun grep result: no unsanitized $_POST, no string-interpolated SQL, no echo $_GET, no eval/extract/unserialize, no missing permission_callback. 🎯
⚠️ Improvements (actionable, prioritized)
| # | 🔧 Finding | Sev | File:line | Fix |
|---|---|---|---|---|
| 1 | Full mPDF locale zoo + 20 TTFs shipped for minority PDF feature | 🔴 High | vendor/mpdf/** (~138k LOC total) | Strip unused collations/fonts via build prune, or make PDF an optional add-on |
| 2 | PHP 8.3 floor excludes bulk of shared hosting | 🔴 High | quizwizz.php:8 Requires PHP: 8.3 | Lower to 8.1 (union types still available); gate 8.3-only syntax |
| 3 | ✅ RESOLVED 2026-07-24 — dead allow() wrapper (returned true on storage error) | 🟠 Med | RateLimiter.php:116-118 | Deleted wrapper + doc comment (zero callers plugin-wide); consume() is the sole API. Verified: method_exists(RateLimiter,"allow") → false, consume → true, plugin re-activates with no fatal, REST rate-limit endpoint still 200 |
| 4 | 680-line all-static controller, no DI → untestable | 🟠 Med | GenerateController.php | Extract PDF/logo/selection collaborators; inject PdfGenerator |
| 5 | new PdfGenerator() hard-wired blocks test doubles | 🟠 Med | GenerateController.php:595 | Constructor/param injection |
| 6 | Repeated release-or-503 block ×6 | 🟡 Low | OpenRouterClient.php:109,131,146,155,161,166 | Behavior-neutral refactor; deferred to release owner (unverifiable on a built artifact, not worth hand-editing) |
| 7 | ✅ RESOLVED 2026-07-24 — dead QUIZWIZZ_VER alias | 🟡 Low | quizwizz.php:23-24 | Removed (used only at its own definition; QUIZWIZZ_VERSION retained). Verified: defined("QUIZWIZZ_VER") → false, defined("QUIZWIZZ_VERSION") → true, no fatal on activate |
| 8 | Tested up to: 7.0 is coincidental, not a claim | 🟡 Low | quizwizz.php:11 | Test matrix + CI against 6.3→current |
📋 Remediation checklist
- 🔴 Prune
vendor/mpdflocale/font payload — release-owner (locked build pipeline) - 🔴 Drop PHP floor to 8.1; add syntax gate — release-owner
- 🟠 ✅ Delete
RateLimiter::allow()andQUIZWIZZ_VER— both removed on bench, verified no fatal - 🟠 Break
GenerateControllerinto collaborators — release-owner (large refactor on built artifact) - 🟡 Collapse AI settle/release duplication into
finally— release-owner (behavior-neutral) - 🟡 Establish WP compat CI (6.3 → latest) — release-owner
- 🟢 ✅ Re-audit frontend UX (
[quizwizz_craft]) in browser — done; see Frontend audit
📦 Dependency x-ray
| Bundled dep | Purpose | Roast |
|---|---|---|
mpdf/mpdf | HTML→PDF | Ships a .php collation for every locale on Earth + 20 TTFs; the bulk of the plugin |
setasign/fpdi | PDF import/parse | Heavyweight for print-a-quiz |
psr/http-message, psr/log, shims | Interop | Reasonable, small |
myclabs/deep-copy | Object cloning | Transitive weight |
paragonie/random_compat | CSPRNG polyfill | Redundant on PHP 8.3 (its own floor!) |
Irony: requires PHP 8.3 yet ships random_compat, a polyfill for PHP <7. 🃏
🔗 References
- 🌐 QuizWizz bench (app)
- 📖 WP Plugin Security Handbook
- 🧪 WP REST API — permission_callback
- 🗄️
$wpdb->prepare()docs - 📄 mPDF · 🔌 OpenRouter API
- reviewer: automated bench audit (source-read, no dynamic exploit)
- next: frontend UX roast of
[quizwizz_craft]builder