BCL Portal WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.1.8

Findings

2

Worst severity

high

Content hash

fb783fb43931d9e5efb5b1e1… Copy

Findings

• high Unauthenticated REST registration creates WordPress users

  POST /wp-json/bcl/v1/register uses permission_callback __return_true and calls wp_create_user() with attacker-supplied email/password/name, ignoring the site's users_can_register setting. Unauthenticated callers can create subscriber accounts at will (spam, auth stepping-stone).

  inc/api.php:285-360,1678-1680

• medium Firm brand/settings REST routes only require 'read' capability

  Routes such as /firm/brand-kit (GET/POST/PATCH/PUT), /firm/logo, /content/{id}/settings, and /content/{id}/allowed-domains use permission_callback current_user_can('read'), which every logged-in role including subscriber satisfies. Low-privilege users can read/modify firm branding and per-content settings.

  inc/api.php:1566-1650

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.