ElementLayer WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.2.3

Findings

1

Worst severity

medium

Content hash

bc3fa9fecd3c922e31519783… Copy

Findings

• medium CSRF: Pagelayer→Elementor convert form lacks nonce

  csrf

  EL_Admin::page() processes isset($_POST['el_convert']) and calls convert() with no check_admin_referer/wp_nonce_field and no explicit current_user_can() in the handler. A logged-in administrator visiting a malicious page can be forced to create Elementor draft posts and write _elementor_data meta for attacker-chosen post_id values.

  includes/Admin.php:20-30

  Recommendation

  Add wp_nonce_field + check_admin_referer, and re-check current_user_can('manage_options') (and edit_post on the source) before convert().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.