Low-severity findings only.

Audited release

1.1.3

Findings

1

Worst severity

low

Content hash

e4efa021c532660d7496356a… Copy

Findings

• low Username-enumeration REST block bypassable and clobbers other rest_authentication_errors results

  information_disclosure

  prevent_anonymous_username_enumeration() only blocks when $_SERVER['REQUEST_URI'] literally contains 'wp/v2/users'. An unauthenticated request to /?rest_route=%2Fwp%2Fv2%2Fusers (URL-encoded slashes) has no literal match, so the plugin returns null and core serves the user list with slugs, defeating the plugin's stated purpose. The '/wp/v2/posts' + _embed check sits inside the users branch and can never match, so /wp/v2/posts?_embed author data is never blocked. Also, because the filter returns null (not the incoming $result) on every non-matching request, it discards any WP_Error that an earlier-priority rest_authentication_errors callback (e.g. another hardening plugin that disables anonymous REST) has returned.

  codepotent-username-protection.php:311-342

  Recommendation

  Accept and return the incoming $result parameter; decide based on the parsed REST route (e.g. hook rest_pre_dispatch / rest_endpoints and check $request->get_route()) instead of a substring of REQUEST_URI, and handle the posts?_embed case outside the users branch.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.