Medium-severity findings.

Audited release

0.16.2

Findings

1

Worst severity

medium

Content hash

25e9f8240b7814bd1ddd0a2e… Copy

Findings

• medium Settings save relies on nonce without capability check

  missing_capability

  df_wc_sendmailsio_settings_form updates API key/endpoint options after wp_verify_nonce only, without current_user_can. The form is normally only rendered on a manage_options submenu, but defense-in-depth is missing if the function is invoked from another context or a privileged nonce is obtained.

  woo-sendmailsio.php:934-953

  Recommendation

  Add current_user_can('manage_options') before updating options; prefer admin_post handler with explicit caps.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.