Taxonomy Transfer WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.1

Findings

2

Worst severity

high

Content hash

35b9a323004e36173bb612d9… Copy

Findings

• high Missing capability and nonce on taxonomy transfer/delete

  csrf

  process_taxonomy_action hooks admin_init and, when POST fields are present, transfers or deletes taxonomy relationships for every post of a type. There is no current_user_can('manage_options') check and no nonce despite the Tools page advertising manage_options. A CSRF form or any authenticated user who can trigger admin_init with POST can mass-modify terms.

  taxonomy-transfer.php:174-245

  Recommendation

  Gate with current_user_can('manage_options') and check_admin_referer; add nonces to both forms.

• medium AJAX taxonomy listing lacks capability and nonce

  missing_capability

  wp_ajax_get_taxonomies_for_post_type echoes taxonomy labels/slugs for a posted post_type with no capability or nonce check (any logged-in user).

  taxonomy-transfer.php:253-268

  Recommendation

  Require manage_options and check_ajax_referer.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.