Send Reservation Mail by I am Root WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

3.1.0

Findings

1

Worst severity

high

Content hash

54a7a11919e0441c86cb3afb… Copy

Findings

• high Unauthenticated reservation-form-submit.php triggers emails via wp-load bootstrap

  missing_auth

  app/reservation-form-submit.php requires wp-load.php from DOCUMENT_ROOT and calls send_email($_POST['reservation_id']) with no capability, nonce, or login check. Any visitor who can POST a Formidable/reservation entry ID triggers thank-you email to that reservation's email and inserts a tracking row. Exposed via plugin_dir_url from the admin dashboard partial.

  app/reservation-form-submit.php:1-7

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.