ManageMe Promo Code WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.8

Findings

1

Worst severity

medium

Content hash

8ce01aaf7c884d2cc4a2804e… Copy

Findings

• medium Unauth AJAX promo validator lacks nonce and proxies attacker path segments

  missing_auth

  wp_ajax_nopriv_validate_promo_code takes society_id and promo_code from $_POST without nonce or capability check and interpolates them into a remote API URL via wp_remote_get. shop_url comes from ACF options (admin). Unauth callers can probe arbitrary society/promo paths on manage-me.pro and receive debug_api_url in responses. CSRF of validation is low-impact; main issue is missing auth/nonce on a public SSRF-to-fixed-host proxy with info leak.

  manageme-promocode.php:133-173

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.