Content Importer WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

3.4.5

Findings

1

Worst severity

high

Content hash

f21c04f6d3ae9860881db41d… Copy

Findings

• high AJAX health_check and getBraftonArticles lack capability and nonce checks

  missing_capability

  wp_ajax_health_check and wp_ajax_getBraftonArticles are callable by any authenticated user. health_check proxies a remote request; getBraftonArticles returns imported article titles/edit links. No check_ajax_referer or current_user_can.

  admin/_BraftonAdminFunctions.php:81-139

  Recommendation

  Restrict to manage_options and verify an admin AJAX nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.