gPeople WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

3.4.7

Findings

2

Worst severity

high

Content hash

c306aad2459bc508d32fee33… Copy

Findings

• high Missing capability checks on gPeople remote AJAX (dynamic sub_* dispatch)

  missing_capability

  gPluginAjaxCore::ajax verifies a nonce then call_user_func_array on sub_{$post['sub']}. gPeopleRemoteAjax::sub_store_meta writes people meta and taxonomy terms for a client-supplied post ID without checking edit_post/current_user_can. Any authenticated user can invoke these actions.

  gplugin/ajaxcore.class.php:20-40

  Recommendation

  Require appropriate caps (e.g. edit_post for the target post_id, manage_categories for term insert) inside each sub_* handler or centrally before dispatch. Avoid exposing arbitrary sub_* methods.

• high Unauthenticated-capability gap: sub_store_meta modifies post people data

  missing_capability

  sub_store_meta builds meta from POST and calls update_postmeta/set_post_terms without verifying the user may edit that post.

  includes/remoteajax.class.php:49-99

  Recommendation

  Add current_user_can('edit_post', $post_id) (or stricter) before mutating meta/terms.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.