Mooberry Story Community WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.15

Findings

1

Worst severity

high

Content hash

645e5688e730a11efb82746e… Copy

Findings

• high Chapter AJAX handlers lack capability checks (IDOR for any logged-in user)

  wp_ajax_save_chapter, get_chapter, mbdsc_delete_chapter, and save_chapters_order verify only mbdsc_story_cpt_ajax_nonce. That nonce is localized on admin_enqueue_scripts for all admin screens with no capability gate. Any authenticated user who can load wp-admin (including subscribers on profile.php) receives the nonce and can create/update/trash arbitrary mbdsc_chapter posts and reorder chapters without edit_mbdsc_stories / edit_post checks.

  includes/stories/class-story-cpt.php:117-236

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.