Fragments LMS WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.5.6

Findings

1

Worst severity

high

Content hash

e38da53decd294ee36ef3e8a… Copy

Findings

• high REST complete endpoint uses permission_callback __return_true

  missing_permission_callback

  flms/v1/complete/... registers permission_callback __return_true. Auth is only via optional 'key' arg validated against FLMS_REST_AUTH_TOKEN / settings token. If token unset/weak, unauth can mark content complete for arbitrary user_id and follow open redirect via redirect param.

  includes/class-flms-module-rest.php:14-42

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.