Low-severity findings only.

Audited release

2.5.31

Findings

1

Worst severity

low

Content hash

69011eeb41ff916c7e0d3469… Copy

Findings

• low check_chargily_connection AJAX missing nonce (CSRF)

  missing_nonce

  wp_ajax_check_chargily_connection handler checks current_user_can(administrator|shop_manager) but never check_ajax_referer/wp_verify_nonce. A CSRF request from an admin/shop_manager browser can coerce the site to send an attacker-supplied Bearer token to Chargily balance API. Impact is limited (connection probe / token validation oracle) but state-changing authenticated AJAX should require a nonce.

  templates/method-v2/API-v2.php:1380-1410

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.