LEANWI Book A Room WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.6.1

Findings

3

Worst severity

high

Content hash

a3610f05119403c5a9d77136… Copy

Findings

• high Staff payment/feedback AJAX exposed via nopriv with nonce-only auth

  missing_capability

  leanwi_staff_mark_payment and leanwi_staff_send_feedback_request_email are registered on wp_ajax_nopriv_ and only verify a nonce (mark_payment_nonce). No current_user_can / booking_staff role check in the handler. Staff UI shortcodes gate nonce emission to booking_staff, but the AJAX itself accepts any valid nonce for that action (including uid-0 if ever emitted). Anyone who obtains the nonce can toggle has_paid and trigger feedback emails.

  php/ajax/staff-mark-payment.php:4-36

• high Unauth delete_recurrence AJAX with nonce-only auth and no staff role check

  missing_capability

  leanwi_delete_recurrence is nopriv-reachable and deletes recurrence rows plus future participants after nonce check only. No booking_staff / capability verification in the handler.

  php/ajax/delete-recurrence.php:4-44

• medium Client-controlled is_booking_staff bypasses past-booking cancel restriction

  delete-booking.php reads is_booking_staff from JSON body via filter_var. An unauthenticated caller with a public delete_booking_nonce (emitted on venue details frontend) can set is_booking_staff=true to cancel past bookings and alter cancellation email wording.

  php/ajax/delete-booking.php:16-40

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.