MiniMax M3.1 (Space Bunny) caught a WordPress plugin auth bypass in a security audit

Juraj Bednar🏴💛🌘 @jurbedOriginally posted 2026.10.22

Open original on X

CashuPayServer v0.5.7-alpha is out — the second release from this October's three independent security audits, and it closes every code-side finding they left open. If you've patched your PHP already, you can also upgrade CashuPayServer. If not, patching PHP is more important, go do that. The most serious one was in the WordPress plugin: showing the seed phrase or downloading the database accepted any password, because the already-open admin session was the only check (but you still needed to be logged in as admin into WordPress). It now asks for your real WordPress password. MiniMax M3.1 found that one, and it is again the model that caught something the earlier scans missed. The rest of the important fixes: - Stranded-funds exports now reserve the money, so the same ecash cannot be handed out twice or spent while the token circulates. - The setup wizard can no longer be re-entered to reset the admin password or keep a previous claimant's server address. - Fiat pricing needs two independent sources to agree, so one bad provider cannot underprice invoices. - An interrupted wallet backup no longer leaves a full copy of the database behind. - Public token submissions are bounded, closing a request that could burn minutes of CPU. - Trusted-proxy settings can no longer name the whole internet. Upgrading takes a couple of minutes and there is nothing to configure: - Standalone: upload the new files over the old ones, keeping your data folder. - WordPress: upload the plugin and choose "Replace current with uploaded". The database updates itself on your first visit. Three audits, three models: DeepSeek 4.1 Flash 1017, Opus 5.5 and MiniMax M3.1 (Space Bunny). They found real issues at every level, including the WordPress one above. What changed? We used the same models for previous audits, but this time we used the cloudflare security audit skill: https://github.com/cloudflare/security-audit-skill Highly recommended, it's good. 👉 Download: https://github.com/jooray/cashupayserver/releases/tag/v0.5.7-alpha