Medium-severity findings.

Audited release

7.2.9

Findings

1

Worst severity

medium

Content hash

5e5f1f2a5542abebde47a5c5… Copy

Findings

• medium Multiple direct-access PHP entry points bootstrap via wp-load.php

  export.php, rundan.php, index.php and cron helpers include wp-load.php outside normal WP routing. export.php relies on HTTP_REFERER matching wp-admin then includes foradmin.php (which correctly requires vtupress_access_vtupress). Referer checks are spoofable; defense rests entirely on the custom capability after bootstrap. Shell_exec crontab helpers under crons/ expand host attack surface if those scripts are web-reachable. Marks unnecessary attack surface / fragile auth layering.

  export.php:1-40

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.