WP2Static Add-on: Advanced Crawling Options WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.0-alpha-002

Findings

2

Worst severity

medium

Content hash

a8fc9ec987d7d8337138067e… Copy

Findings

• medium Save options admin-post missing capability check

  missing_capability

  saveOptionsFromUI is hooked to admin_post_wp2static_advanced_crawling_save_options and only calls check_admin_referer('wp2static-advanced-crawling-options') before writing crawl options. There is no current_user_can('manage_options'). Any authenticated user can create that nonce and POST to admin-post.php to change crawling settings.

  src/Controller.php:256-310

  Recommendation

  Add current_user_can('manage_options') (matching the options submenu capability) before applying updates.

• medium Save options admin-post missing capability check

  missing_capability

  saveOptionsFromUI is hooked to admin_post_wp2static_advanced_crawling_save_options and only calls check_admin_referer('wp2static-advanced-crawling-options') before writing crawl options. There is no current_user_can('manage_options'). Any authenticated user can create that nonce and POST to admin-post.php to change crawling settings.

  src/Controller.php:256-310

  Recommendation

  Add current_user_can('manage_options') (matching the options submenu capability) before applying updates.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.