WP Bonnier SoMe WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

2.0.5

Findings

3

Worst severity

high

Content hash

6816ef4592c084b2a13379cc… Copy

Findings

• high Inverted capability check on Instagram options REST

  auth_bypass

  FacebookController::options redirects away when user_can(...,'manage_options') is true, and proceeds to saveInstagramAccount for everyone else (including subscribers and uid 0). Combined with missing permission_callback on the CREATABLE route, low-priv users can set the Instagram account option.

  src/Http/Controllers/FacebookController.php:29-41

  Recommendation

  Invert the check to require manage_options; add permission_callback accordingly.

• high Unauthenticated OAuth logout deletes access tokens

  missing_auth

  REST logout callbacks call accessTokenService->delete() and (Facebook) delete_option(INSTAGRAM_ID) with permission_callback omitted/public and no capability check—any visitor can disconnect SoMe.

  src/Http/Controllers/FacebookController.php:18-26

  Recommendation

  Require manage_options (or a logout nonce tied to admin session).

• medium REST OAuth routes registered without permission_callback

  missing_permission_callback

  Routes for authorize/callback/logout/options omit permission_callback, relying on ad-hoc checks that are missing or inverted.

  src/Http/Routes.php:46-70

  Recommendation

  Declare explicit permission_callbacks for each route.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.