LWR Events WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.8.0.6

Findings

3

Worst severity

high

Content hash

7bc82c51d25c26fc27be0be6… Copy

Findings

• high Unauthenticated event RSVP for arbitrary user IDs

  wp_ajax_nopriv_user_sign_event handles user_sign_event with no nonce, capability, or login check. POST supplies userID, eventID, and signInState; the handler inserts/updates lwrevents_signin for that uid and sends email. An unauthenticated caller can mark any user as attending/declining any event.

  core/LWREventsCore.php:407-432

• medium Unauth AJAX discloses event signup usernames

  wp_ajax_nopriv_update_sign_table returns counts and comma-separated user_login values for yes/maybe/no RSVPs for any eventID with no auth.

  core/LWREventsCore.php:363-376

• medium Unauth generate_calendar dumps full post and all postmeta

  wp_ajax_nopriv_generate_calendar returns get_post() ARRAY_A plus get_post_meta() for attacker-chosen eventID, exposing private meta if present.

  core/LWREventsCore.php:273-284

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.