Medium-severity findings.

Audited release

1.0.0

Findings

1

Worst severity

medium

Content hash

11dd841828fa994f835482a9… Copy

Findings

• medium Any logged-in user can export Breakdance global styles with no capability or nonce check

  missing_capability

  admin_post_bd_export_settings is hooked to BD_Global_Styles_Export::export_settings with no current_user_can() and no nonce. WordPress fires admin_post_{action} for every authenticated request to wp-admin/admin-post.php, including Subscriber and WooCommerce Customer. The settings UI is a Breakdance admin tab and the import sibling correctly requires manage_options plus nonce bd_import_settings, but the export form in settings-page.php posts action=bd_export_settings with neither a nonce field nor a hidden cap gate, and the handler itself never re-checks. A logged-in low-privilege user (or an attacker who CSRF's any logged-in victim, since GET is enough) requests /wp-admin/admin-post.php?action=bd_export_settings. If the option exists, the handler sends Content-disposition: attachment and Content-Type: application/json, then echo $export_setting and exit. Observable: the HTTP body is the raw breakdance_global_settings_json_string value — the site-wide Breakdance global settings blob (colors, typography, and any custom CSS/JS / tracking snippets stored there) that Breakdance uses to generate front-end global styles. This is not unauth, not a write, and not frontend XSS (attachment + application/json). It is a missing-authorization read of administrator-only builder configuration.

  breakdance-global-styles-json-export.php:49-84

  Recommendation

  In export_settings, require current_user_can('manage_options') and check_admin_referer() (or wp_verify_nonce with a dedicated action). Add wp_nonce_field to the export form in settings-page.php. Deny with wp_die() before reading or echoing the option. Keep the existing manage_options + nonce gate on import_settings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.