Connexions Import WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.2

Findings

1

Worst severity

medium

Content hash

fc55ab01b5d5d667fe74684a… Copy

Findings

• medium Unauthenticated import processor AJAX

  bbconnect_import_do_import is registered for nopriv and ajax_do_import() never checks current_user_can or a nonce. While CSV upload requires add_users, any unauthenticated client can continue importing users from a pending file.

  classes/import.class.php:27-28,329-380

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.