Keen Training WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

2.9.12

Findings

1

Worst severity

medium

Content hash

dc6b0e30664bc31a1167597d… Copy

Findings

• medium Hardcoded default passwords for provisioned users

  predictable_token

  ajax_admin_create_user always assigns a static password: 'cultivartalentos' for kt_location_manager and 'fazerbemfeito' for other allowed roles. These strings are in the plugin source. After an admin creates users (optionally emailing them), attackers who learn the username can authenticate until the user changes the password. Capability gate is kt_admin-only for creation, but the resulting accounts are weakly credentialed by design.

  frontend/class-frontend.php:901-903

  Recommendation

  Generate a strong random password per user (wp_generate_password), force reset on first login, and never ship shared plaintext defaults in source.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.