Creative Pixel Bundle WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.0

Findings

3

Worst severity

high

Content hash

8481d11c52e74a0626c20c23… Copy

Findings

• high ultra_savemenu AJAX missing capability check

  missing_capability

  wp_ajax_ultra_savemenu verifies ultra-nonce only. ultra_scripts() localizes that nonce on admin_enqueue_scripts for every wp-admin user (including subscribers viewing profile). Any authenticated admin-capable-of-loading-wp-admin user can reorder/disable admin menus site-wide.

  ultra-admin/lib/ultra-menu-settings.php:245-268

• medium Unauthenticated Redux open SSRF proxy registered

  ssrf

  Redux_P registers wp_ajax_nopriv_redux_p with valid_url_regex='/.*/' and enable_native=true, fetching attacker-controlled url via wp_remote_request. Gated only by redux-ads-nonce (created when dev_mode true). Default config has dev_mode false, but nopriv open-proxy surface remains unnecessary attack surface / SSRF if nonce leaks or dev_mode enabled.

  ultra-admin/framework/core/inc/class.p.php:7-165

• low Hourly phone-home of site metadata to creativepixel.design

  information_disclosure

  Cron my_hourly_event POSTs blog version, title, URL, and plugin version to http://creativepixel.design/rec.php over cleartext curl. Unnecessary external disclosure.

  cpb.php:214-242

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.