Writify WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.2.9

Findings

1

Worst severity

medium

Content hash

009c29482660317f37a8ae3b… Copy

Findings

• medium Public writify/v1/event_stream_openai relies on scrapable wp_rest nonce

  REST route registers permission_callback __return_true. Handler verifies wp_create_nonce('wp_rest') which anonymous users can obtain, then loads Gravity Forms entries by id and streams OpenAI feed processing. Unauthenticated callers who know/guess form_id+entry_id can trigger AI processing (API cost/DoS) and potentially observe entry-derived output in the SSE stream.

  writify-gform-openai.php:85-93,808-860

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.