Webbedrijf.nl core WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.5

Findings

2

Worst severity

high

Content hash

7fa515d44c4681a57e9c10b8… Copy

Findings

• high REST SSO routes missing permission_callback

  missing_permission_callback

  Both create-login-link and login register_rest_route calls omit permission_callback. On WordPress 5.5+ this triggers _doing_it_wrong and forces deny; on older WP the routes are public and rely solely on the custom token header check inside createLink (login has no secret beyond the transient token).

  app/Http/V1/Controllers/LoginController.php:14-26

  Recommendation

  Add permission_callback that validates the SSO token (for create) and __return_true for the one-time login GET.

• medium SSO tokens generated with rand() and login token passed in GET URL

  predictable_token

  Fallback SSO token and login tokens use rand()-based generateRandomString, not CSPRNG. Login token is placed in a GET query string (Referer/log leakage). Token also displayed in Carbon Fields settings (readOnly).

  app/Http/V1/Controllers/LoginController.php:71-126

  Recommendation

  Use random_bytes()/wp_generate_password(32,true,true); prefer POST body or fragment for one-time tokens; avoid logging URLs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.