Dailymotion Video Player Plugin WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.5.2

Findings

2

Worst severity

medium

Content hash

6487eaba237245465d4c6403… Copy

Findings

• medium REST endpoints expose Dailymotion credentials to edit_posts users

  missing_capability

  dm/v1/get-api-key and related routes use permissions_check() returning current_user_can('edit_posts'). Any Author/Editor can read dm_ce_credentials (API key/secret) and call update-auto-embed / migration to change site-wide embed options. Credential disclosure and settings BAC should require manage_options.

  api/Custom_Get_Options.php:43-183

  Recommendation

  Require manage_options for credential read and option write routes; keep edit_posts only for non-sensitive post-meta reads used by the block editor.

• medium update-auto-embed allows Contributors/Authors to write global embed options

  missing_capability

  EDITABLE /update-auto-embed/ updates option dm_ce_options_auto_embed with only edit_posts. That option is consumed by front-end shortcodes/player embeds — below-admin write of playback/player settings.

  api/Custom_Get_Options.php:83-161

  Recommendation

  Gate with manage_options; validate schema of JSON body.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.