Boat Builder WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.4.1

Findings

1

Worst severity

medium

Content hash

f668801e8effc678a562a08d… Copy

Findings

• medium Public boat-builder REST forms missing permission_callback (PDF upload + mail)

  register_rest_route for boat-builder/v1/email and /dealer omit permission_callback. Handlers accept multipart PDF via wp_handle_upload and email it. On WP <5.5 this was publicly callable (unauth file upload + mail abuse). On WP 5.5+ missing callback defaults to deny (forms broken until __return_true is added). Defense-in-depth: even when made public intentionally, upload should restrict MIME and rate-limit.

  boat-builder.php:435-445

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.