Barista WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

0.8.21

Findings

2

Worst severity

medium

Content hash

cddf649e964e6aa6649fcc78… Copy

Findings

• medium barista-get_admin_menus AJAX has no nonce or capability check

  missing_capability

  wp_ajax_barista-get_admin_menus loads wp-admin menu.php and returns the Barista command Collection via wp_send_json_success with no check_ajax_referer and no current_user_can. Any authenticated user (including Subscriber) can invoke admin-ajax.php?action=barista-get_admin_menus and receive the aggregated admin command/menu metadata exposed to the palette.

  inc/frontend.php:12-36

  Recommendation

  Require check_ajax_referer and a capability such as edit_posts or manage_options before returning the collection.

• low barista_run_action authenticates with per-command nonce only at gate

  missing_capability

  init_ajax_request verifies a per-command nonce but does not enforce a baseline capability. Individual command hooks (e.g. plugin activate) do check current_user_can; residual risk is any command hook that omits its own cap check. Scripts also enqueue on the frontend for logged-in users.

  inc/ajax.php:20-38

  Recommendation

  After nonce verification, require an admin capability (e.g. manage_options) unless the specific command documents a lower gate.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.