Beaver Builder - Lazy Load WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.1

Findings

1

Worst severity

low

Content hash

14515f41436cf7999b5993ca… Copy

Findings

• low Settings save via admin_action lacks capability check

  missing_capability

  bbll_admin_form_action is hooked to admin_action_bbll_admin_form and only verifies nonce bbll_admin_update_settings before writing bbll_store and calling FLBuilderModel::delete_asset_cache_for_all_posts(). The options page requires manage_options, but the action handler does not call current_user_can. Any logged-in user who can obtain/create that nonce can flip lazy-load settings and flush BB caches. Impact is cosmetic/performance only, so severity is low per blast-radius guidance.

  bb-lazy-load.php:52-74

  Recommendation

  Add current_user_can('manage_options') (or equivalent) immediately after nonce verification and die on failure. Prefer the Settings API / options.php flow instead of a raw admin_action.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.