High-severity findings.

Audited release

26.9.4-185

Findings

2

Worst severity

high

Content hash

bd0de9f0eb90afd40245514a… Copy

Findings

• high Unauthenticated crate packaging and compost (delete) REST endpoints

  missing_permission_callback

  Routes xophz-produce/v1/package and /compost register permission_callback __return_true. package_crate() inserts into {prefix}edvex_crates; compost_data() deletes by crate_id. No capability, nonce, or API key is checked. Unauthenticated callers can fill or wipe the crates table.

  includes/class-xophz-compass-produce-api.php:38-71

  Recommendation

  Require manage_options (or a capability matching the admin UI) on mutating routes; keep public only intentional read-only discovery endpoints.

• medium Public harvest/providers endpoints disclose internal provider registry

  information_disclosure

  GET /providers and /harvest return get_active_providers() aggregates (schemas, data_points, token estimates) to unauthenticated clients. Lower blast than writes but unnecessary information disclosure if providers are sensitive.

  includes/class-xophz-compass-produce-api.php:25-36

  Recommendation

  Restrict to authenticated admins unless public discovery is an explicit product requirement.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.