Post Exporter WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

medium

Content hash

5ce35296989e81e1bf728069… Copy

Findings

• medium post_exporter_* AJAX missing capability checks

  ajax_export/ajax_list/ajax_clear only call check_ajax_referer('post_exporter_nonce'). Menu requires manage_options but AJAX does not re-check. Combined with CSRF or nonce reuse this allows unauthorized CSV export of all posts into the theme exports folder.

  post-exporter.php:131-281

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.