WP Admin Boost WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.0.3

Findings

2

Worst severity

medium

Content hash

ba621abd04605d3a143ba70b… Copy

Findings

• medium CSRF: settings save does not verify nonce

  csrf

  options_page_html handles POST by calling update_option for all wpab_* settings without wp_verify_nonce/check_admin_referer. The form outputs a nonce via settings_fields('wpab'), but the custom handler that posts back to the settings page never validates it. An attacker can CSRF a logged-in administrator into changing CDN acceleration toggles and the blocked-plugin list.

  wp-admin-boost.php:259-267

  Recommendation

  Call check_admin_referer('wpab-options') (or verify the settings_fields nonce) before any update_option, and move the current_user_can('manage_options') check above the POST handling.

• low Capability check runs after state-changing POST

  missing_capability

  In options_page_html, update_option calls execute on POST before current_user_can('manage_options'). WordPress submenu registration still requires manage_options to reach the callback, so this is not a direct privilege escalation, but the inverted order removes defense-in-depth if the callback is ever invoked another way.

  wp-admin-boost.php:259-272

  Recommendation

  Check current_user_can('manage_options') (and multisite manage_network_options when applicable) before processing POST.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.