Ink Assistant WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

2

Worst severity

medium

Content hash

d0ebfd9c1fb394228af8a7af… Copy

Findings

• medium Contact form email header injection via unsanitized name

  unsafe_input

  Successful submissions build wp_mail headers as 'From: ' . $name . ' <' . $email . '>' where $name is only trim()'d. CRLF in contactName can inject Bcc/Subject headers. Email is validated with is_email; form lacks CSRF nonce so unauthenticated spam/header abuse is possible.

  includes/shortcodes/contact-form.php:45-59

  Recommendation

  Sanitize $name with sanitize_text_field and strip CR/LF; prefer Reply-To only and a fixed From address; add nonce + rate limiting.

• medium AJAX gallery save checks edit_posts but not capability on target post_id

  missing_capability

  stag_save_images verifies nonce and current_user_can('edit_posts') then writes stag_image_ids meta for attacker-supplied $_POST['post_id'] without current_user_can('edit_post', $post_id). Authors/contributors with edit_posts can modify gallery meta on others' posts (IDOR).

  includes/meta/stag-admin-metabox.php:390-412

  Recommendation

  absint the post_id and require current_user_can( 'edit_post', $post_id ) before updating meta.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.