Low-severity findings only.

Audited release

1.1.0

Findings

2

Worst severity

low

Content hash

7b4305bf7858f3b40f0be40d… Copy

Findings

• low Direct-access PHP bootstrap via wp-load.php path walk

  unnecessary_attack_surface

  yii/download.php walks parent directories to require wp-load.php then runs YiiEmbedDownload. After bootstrap it correctly requires manage_options, so this is unnecessary attack surface rather than an auth bypass on a default install.

  yii/download.php:37-71

  Recommendation

  Route downloads through admin-ajax or admin-post with capability checks instead of a standalone wp-load bootstrap.

• low Deprecated create_function used for admin notices

  outdated_software

  YiiEmbedAdmin::notice builds a create_function closure to echo admin notices. create_function is removed in PHP 8+ and is a brittle pattern; values are admin-controlled so not directly exploitable here.

  includes/YiiEmbedAdmin.php:82-82

  Recommendation

  Replace with a proper closure or dedicated callback method.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.