Xophz Magic Formulas WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

26.9.21-627

Findings

2

Worst severity

high

Content hash

4c476b733ed0739df9888e4c… Copy

Findings

• high Unauthenticated Forminator submission disclosure

  information_disclosure

  GET magic-formula/v1/submissions/{id} uses check_permission (always true) and returns Forminator entry meta including email fields extracted from entry meta_data.

  includes/class-xophz-compass-magic-formula-rest.php:323-360

  Recommendation

  Require admin capability before returning Forminator entries; never expose raw PII to anonymous REST clients.

• high Unauthenticated option write via save_mappings

  missing_auth

  POST magic-formula/v1/mappings calls update_option('questbook_form_mappings', ...) with attacker-controlled mapping arrays because permission_callback is check_permission (always true).

  includes/class-xophz-compass-magic-formula-rest.php:260-284

  Recommendation

  Gate write routes with manage_options (or equivalent) and verify REST nonce / cookie auth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.