TM Mega Menu WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.1.4

Findings

1

Worst severity

high

Content hash

b0492990d3b6cc1a34147279… Copy

Findings

• high Mega menu widget AJAX handlers lack capability checks

  missing_capability

  All tm_mega_menu_* widget AJAX actions (add/save/delete/move/update_columns/edit) and save_settings only call check_ajax_referer — there is no current_user_can( 'edit_theme_options' ) anywhere in the plugin. Any authenticated user who obtains the tm_mega_menu nonce can inject widgets (including Custom HTML) into the mega-menu sidebar that renders on the public site, enabling stored XSS / menu defacement.

  core/includes/class-tm-mega-menu-widget-manager.php:111-238

  Recommendation

  Require current_user_can( 'edit_theme_options' ) (and edit_theme_options for save_settings) at the start of every AJAX handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.