Gravity Forms IP Submission Limit WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.1

Findings

1

Worst severity

medium

Content hash

0c36adcd11b138f3913b3aea… Copy

Findings

• medium clear_ip admin_post lacks CSRF nonce

  csrf

  admin_post_clear_ip requires manage_options and deletes option gf_ip_submissions_{ip}, but never calls check_admin_referer/wp_verify_nonce. A cross-site request from an admin session can clear Gravity Forms IP submission counters, weakening rate limits for targeted IPs. Blast radius is limited to counter reset (not form settings or submissions).

  inc/ip-restrictions-tab.php:73-89

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.