Medium-severity findings.

Audited release

2.5

Findings

1

Worst severity

medium

Content hash

1f25bf5777ed69977256932b… Copy

Findings

• medium Unauthenticated-to-Subscriber CircleCI trigger via loco_json AJAX

  missing_capability

  LocoWebhook::init is hooked to wp_ajax_loco_json without verifying nonce or capability. Any authenticated user can POST route=save and a path under WP_CONTENT_DIR; on loco_admin_shutdown the plugin may call CircleCI using p4_sync_ci_token.

  sync-language-files.php:82-138

  Recommendation

  Require current_user_can('manage_options') or loco's own capability and verify Loco's nonce before registering the shutdown ping.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.