Sudo

Sudo — concluded


So full of cracks, the barrier gatehouse of Fuwa lets both rain and moonlight in — quietly exposed, yet enduring.

— [Abutsu-ni](https://en.wikipedia.org/wiki/Abutsu-ni), *Diary of the Waning Moon*

This 13th-century poem was chosen at the start of this project, for its gate metaphor. It turned out to describe the project all too well: Sudo's barrier gate had cracks too — seven of them, all verified — and what endures is not the gate but the record of where the light came through.

[!CAUTION] **Do not install this plugin.** Not on production, not on staging, not on any site with real users, credentials, or data. It contains seven verified high-severity bypasses of its own central claim. They are documented rather than fixed, because they are the result.

Sudo was a six-month research prototype investigation of action-gated reauthentication in WordPress exploring one question, initially: What if WordPress requires a fresh proof of intent before consequential operations, regardless of role? It took its name and its symbol from the gate: 門, the radical that runs through East Asian writing, evoking the fortified pass where everyone and everything attempting to cross the gate is examined rather than trusted. The project is finished. This repository is archived and read-only.

What was tried, and what happened

WordPress asks for your password once, at login, and then never again. A valid session cookie is permission to do anything — install a plugin, which is arbitrary code execution; change another user's email and then their password; make every new signup an administrator. Steal the cookie, and you have the site.

The idea was to put a gate in front of the dangerous operations: notice the request, demand the password again, and only then let it through.

**The gate could not reliably tell which requests were dangerous.** Not because the list of dangerous operatio