Formidable Copy Action WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

2.0.0

Findings

2

Worst severity

medium

Content hash

a035435d020d92fd77f043fb… Copy

Findings

• medium Predictable form-copy-security token replaces real nonce

  predictable_token

  formSecContent shortcode returns base64_encode($act) as the security token. ajaxGetFormFields/ajaxGetUpdateFields only check that base64_decode(token)==action. Any logged-in user can forge form-copy-security=Z2V0X2Zvcm1fZmllbGRz and enumerate Formidable form field structures.

  class/FormidableCopyActionAdmin.php:81-210

• medium Form field AJAX missing capability check

  missing_capability

  get_form_fields / get_form_update_fields AJAX handlers have no current_user_can gate alongside the forgeable token check.

  class/FormidableCopyActionAdmin.php:180-210

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.