Decoupled Support WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.10.0

Findings

2

Worst severity

high

Content hash

75ab1c71307a44f02da44b32… Copy

Findings

• high Public decoupled-notify endpoint accepts arbitrary payloads without auth

  missing_auth

  EDITABLE /wp/v2/decoupled-notify uses __return_true. validateRequest only checks JSON has date/tags/payload keys, then set_transient stores the raw body for 24h for downstream consumers.

  includes/CallbackNotifications.php:19-45

  Recommendation

  Authenticate notify callers with a shared HMAC or Application Password; reject unauthenticated writes.

• medium Headless read routes use blanket __return_true

  missing_permission_callback

  permalink, menus, and list routes admit everyone via __return_true, expanding public content surface beyond core REST filters.

  includes/RestPermalink.php:51-55

  Recommendation

  Align with core REST permission model or shared headless auth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.