Premia Demo WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

5.6.2.3.0

Findings

1

Worst severity

medium

Content hash

33f9e8fe42220c38f42e3ad2… Copy

Findings

• medium License settings POST uses broken nonce check and updates tag outside nonce gate

  missing_nonce

  settings_page() is manage_options-gated via menu, but on POST it calls wp_verify_nonce($_POST['_wpnonce']) with no action string (always fails meaningfully) and still executes update_option($tag_option_name, $tag) outside the nonce success branch. An admin CSRF can flip the Premia tag option; license update path is similarly weakly verified.

  premia-demo.php:98-145

  Recommendation

  Use check_admin_referer('premia_demo_license'); require manage_options explicitly in handler; do not update options when nonce fails.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.