Pocket Showroom Core WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

3.4.5

Findings

3

Worst severity

high

Content hash

e4e1b4f92c10ebe72605d799… Copy

Findings

• high REST catalog permission_callback bypasses API key (returns true)

  missing_permission_callback

  Routes under pocket-showroom/v1 for products, single product, categories, and banner use permission_callback verify_api_key_with_rate_limit. That method rate-limits then explicitly comments out verify_api_key and returns true. Despite generating ps_api_key on first run, unauthenticated clients can enumerate the full catalog.

  includes/class-rest-api.php:443-454

  Recommendation

  Restore verify_api_key (or a documented public mode). If public access is required, document it and strip sensitive fields; do not leave a disabled key check that implies protection.

• high CSV batch import AJAX missing capability check

  missing_capability

  handle_batch_process is registered as wp_ajax_ps_process_batch. It only calls check_ajax_referer('ps_batch_nonce'). Any logged-in user can create a valid nonce for that action and, given a filename under uploads/ps-imports/, drive CSV import creating/updating products. handle_cancel_import has no nonce or capability at all.

  includes/class-csv-importer.php:386-390

  Recommendation

  Require current_user_can('manage_options') after the nonce check on batch and cancel handlers; bind filenames to the importing user/session.

• low Public /ping REST discloses site name and plugin version

  information_disclosure

  GET pocket-showroom/v1/ping uses permission_callback __return_true and returns plugin version and blog name. Low-impact information disclosure useful for fingerprinting.

  includes/class-rest-api.php:78-82

  Recommendation

  Require authentication or return a minimal ok status without version/site name.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.