Low-severity findings only.

Audited release

5.4.5 (CVs)

Findings

1

Worst severity

low

Content hash

24ed311e14eaee8060a19719… Copy

Findings

• low Modal create/update handler on admin_init lacks a capability check

  missing_capability

  Amoeba_Settings::handle_save() is hooked to admin_init, which fires for any logged-in user on wp-admin, admin-ajax.php and admin-post.php. It inserts/updates rows in the amoeba_modals table (title, wp_kses_post content, picture/social URLs, custom CSS printed inside a front-end <style> block by the [amoeba_modal] shortcode) gated only by check_admin_referer('amoeba_save_modal_action'), with no current_user_can(). The nonce is only output on the manage_options 'amoeba-settings' page and is user-bound, so a Subscriber cannot normally obtain it; any nonce leak would let a low-privileged user rewrite modal content/CSS shown to visitors.

  includes/amoeba-settings.php:18, 45-73

  Recommendation

  Add if ( ! current_user_can( 'manage_options' ) ) { wp_die(); } at the start of handle_save() (or move it to an admin_post_ action with a capability check).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.