Premia WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1

Findings

1

Worst severity

medium

Content hash

776c80aef90b8209e34c6d36… Copy

Findings

• medium Public license REST endpoints authenticate only via license key and spoofable User-Agent

  missing_permission_callback

  register_rest_route for activate/deactivate/check_updates/download_update sets permission_callback to __return_true. validate_request() only checks that HTTP_USER_AGENT contains 'WordPress' and the claimed site_url — both trivially spoofable. Effective authorization is possession of license_key (and optional do_not_validate product meta). An attacker who obtains a customer license key (phishing, shared support paste, order email) can activate arbitrary site_urls and download release assets without proving control of the licensed domain.

  classes/class-rest-endpoints.php:56-75,412-434,368-404,101-154

  Recommendation

  Keep public permission_callback for license APIs but replace UA checks with signed activation challenges (nonce emailed/DNS/HTML file), bind downloads to HMAC of license+site, rate-limit activate/deactivate, and never enable do_not_validate on paid products.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.