Low-severity findings only.

Audited release

2.7.4

Findings

1

Worst severity

low

Content hash

4f968241de25ac8e0d4a63cb… Copy

Findings

• low Bulk entry export authorized by 'editor' role name, bypassing Gravity Forms export capability

  missing_capability

  GravityExportAddon::handle_bulk_actions() (hooked on wp_loaded in admin context) allows anyone with current_user_can('editor') or current_user_can('administrator') to export the entries of any form ids passed in $_REQUEST['form'], in addition to users with gravityforms_export_entries. Editors do not hold Gravity Forms entry capabilities by default, so this grants them a full PII export of all form entries that Gravity Forms itself would deny. There is no nonce, but the action only streams a download (no state change).

  build/vendor_prefixed/gravitykit/gravityexport-lite-src/Addon/GravityExportAddon.php:1198-1231

  Recommendation

  Gate bulk export only on GFCommon::current_user_can_any('gravityforms_export_entries') (and per-form access), and verify the list-table bulk-action nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.