WP Users WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB-

Medium-severity findings.

Audited release

1.0.5

Findings

3

Worst severity

medium

Content hash

05581230d78be278d2bf1cb2… Copy

Findings

• medium Open redirect after media upload via redirect_url

  unsafe_input

  media_upload redirects to unsanitized $_REQUEST['redirect_url'] when set. Reachable via wp_ajax_wp_users_ajax for logged-in users updating avatar/cover.

  includes/class-action.php:563-566

  Recommendation

  Use wp_safe_redirect and validate against allowed hosts / home_url.

• medium Admin settings save lacks nonce (CSRF)

  csrf

  admin-display.php updates wp_users_settings from $_POST['wp_users_settings'] on submit without nonce. Page capability is edit_users. Can change login/logout redirects and disable default login.

  admin/partials/admin-display.php:33-36

  Recommendation

  Add check_admin_referer; sanitize redirect URLs.

• low Unauthenticated AJAX login/register/reset without nonce

  missing_nonce

  wp_ajax_nopriv_wp_users_ajax dispatches do_login/do_register/retrieve_password without nonce. Functionally similar to wp-login.php but increases CSRF login/logout confusion and spam registration surface.

  includes/class-user.php:311-312

  Recommendation

  Add action-specific nonces for state-changing ajax acts.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.