Brandsite Admin Theme WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.0.16

Findings

1

Worst severity

low

Content hash

094a487f6de15eafbb61e150… Copy

Findings

• low Nopriv admin_post handlers rely on nonce only

  missing_capability

  ImportExport, Upload, and Update register admin_post_nopriv_* for export/import/font/image/admin_form. Handlers verify nonce but never current_user_can(manage_options). Nonces only appear on options page, limiting practical unauth impact; still missing capability defense-in-depth.

  adminThemeClasses/ImportExport.php:41-49

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.