Never Say Retail Live Engine WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

4.9.4

Findings

1

Worst severity

low

Content hash

fc964b42a18537adc5c5835e… Copy

Findings

• low show_mode_trigger admin_post handler lacks nonce verification

  csrf

  nsr_handle_live_action on admin_post(_nopriv)_nsr_live_action checks manage_options then updates live state for show_mode_trigger without check_admin_referer. Unauth is blocked; logged-in admins are CSRF-able for cosmetic banner state. Primary admin_init POST handler correctly uses check_admin_referer.

  never-say-retail-live-engine.php:14-46

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.