PS Community WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.5

Findings

4

Worst severity

high

Content hash

e156b335ffd709d69a46c859… Copy

Findings

• high Unauthenticated user login enumeration via cpc_get_users

  information_disclosure

  wp_ajax_nopriv_cpc_get_users runs a LIKE query on wp_users and returns all matching user_login values as JSON with no authentication, nonce, or rate limit. Enables account enumeration and targeting for password attacks.

  friendships/cpc_friendships_core.php:10-26

  Recommendation

  Remove nopriv registration; require login; restrict results to users the requester may interact with; add nonce + rate limiting.

• high Any logged-in user can sticky/unsticky arbitrary activity posts without nonce

  missing_capability

  cpc_activity_settings_sticky and cpc_activity_settings_unsticky update/delete cpc_sticky post meta for $_POST['post_id'] with no current_user_can check and no nonce. Any Subscriber can pin/unpin any activity post. CSRF-able against any logged-in user.

  activity/ajax_activity.php:396-414

  Recommendation

  Require ownership or manage_options, verify nonce, and validate post type.

• medium Admin option toggles (styles/menu/welcome) lack capability and nonce checks

  missing_capability

  cpc_styles_enable, cpc_styles_disable, cpc_toggle_main_menu, cpc_hide_admin_links_toggle, and cpc_hide_welcome_header_toggle update/delete site options without current_user_can('manage_options') or nonce. Any authenticated user (and CSRF) can change plugin admin UI/style flags. Shortcode/style save handlers correctly require manage_options.

  ajax_admin.php:12-162

  Recommendation

  Gate all admin AJAX with manage_options + check_ajax_referer.

• medium Widespread missing nonces on state-changing community AJAX

  missing_nonce

  Friendship add/accept/reject, activity comment add, forum subcomments, alerts delete, and related handlers perform state changes for logged-in users without wp_verify_nonce/check_ajax_referer, enabling CSRF from a malicious page while a member is logged in.

  friendships/cpc_friendships_core.php:30-55

  Recommendation

  Add per-action nonces to all wp_ajax_* state changers and verify before writes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.