Draft/Live Sync for Content Service WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.10.5

Findings

1

Worst severity

high

Content hash

85769f752e624d053945f0dc… Copy

Findings

• high wp_ajax publish/unpublish/draft handlers lack capability and nonce checks

  missing_capability

  ajax_publish_to_live, ajax_save_to_draft, ajax_unpublish_from_live and related handlers are registered as wp_ajax_* only (logged-in) but never call current_user_can or check_ajax_referer, so any Subscriber can trigger live publish/unpublish.

  lib/draft-live-sync-class.php:872-940

  Recommendation

  Require a publishing capability (e.g. publish_posts) and check_ajax_referer on every handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.