ZWEIPRO Toolbox WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.4.7

Findings

2

Worst severity

high

Content hash

6d9a368b04690afd15327744… Copy

Findings

• high Missing capability and nonce on zweipro_toggle_module AJAX

  missing_capability

  wp_ajax_zweipro_toggle_module updates zweipro_toolbox_active_modules with no current_user_can and no nonce. Any authenticated user (subscriber+) can enable/disable modules including code_snippets (eval of stored PHP) and ProtectedFiles. Module menu itself uses edit_pages but AJAX gate is absent.

  src/Core/Plugin.php:131-147

• medium Code snippets module evals admin-stored PHP on frontend (by design, admin write)

  eval_by_design

  Enabled PHP snippets run via eval(). Write path is manage_options admin UI with nonces — not below-admin writable. Noted as elevated attack surface if toggle BAC is abused after an admin saved a snippet, or paired with XSS. Not standalone RCE for subscribers.

  src/Modules/CodeSnippets/Module.php:29-29

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.