Art Chat Ai WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.3.5

Findings

1

Worst severity

high

Content hash

cc931828c9dd895e67fbe2f9… Copy

Findings

• high Unauthenticated REST routes for AI admin operations

  missing_permission_callback

  Router::register defaults permission_callback to __return_true. Bootstrap registers ping, all-additionals, additional (GET/POST/PUT/DELETE), and change-key without manage_options. Unauthenticated users can invoke remote ChatAI API operations using the site-stored API key. change_api_key() may rotate the remote key before WordPress update_setting() fails the manage_options check — enabling denial of service / remote key rotation.

  src/php/Rest/Admin/Bootstrap.php:19-48

  Recommendation

  Pass manage_options (or stricter) for every admin route; do not rely on update_setting() as the sole auth gate after remote side effects.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.