High-severity findings.

Audited release

3.0.13

Findings

2

Worst severity

high

Content hash

8cc919cbc14585d552d8f047… Copy

Findings

• high Missing capability and nonce on AJAX attachment/post force-delete

  missing_capability

  The action wp_ajax_attachment_revisions_remove_attachment maps to removeAttachment(), which reads $_POST['id'] and calls wp_delete_post($id, true) with no current_user_can() and no nonce/check_ajax_referer. Any authenticated user, including a Subscriber, can permanently delete arbitrary posts, pages, or attachments by POSTing to admin-ajax.php.

  source/php/App.php:26-26,294-313

  Recommendation

  Require a capability such as delete_post / delete_attachment for the target ID, verify a dedicated AJAX nonce, and reject requests that fail either check before calling wp_delete_post.

• medium Unvalidated filesystem path in media restore allows arbitrary file copy into attachment

  file_access

  On edit_attachment, restoreRevision() uses $_POST['media-replace-restore'] directly as the source path for copy() into the current attachment file after only file_exists(). There is no check that the path is under wp_upload_dir() or belongs to this attachment's revision meta. A user who can edit an attachment can supply paths like wp-config.php or other readable files and then download the attachment, disclosing server-local content. Core attachment save nonce still applies, so this is not unauthenticated CSRF, but path validation is absent.

  source/php/App.php:46-76

  Recommendation

  Resolve and realpath() the restore path, require it to be listed in the attachment's _media-replace-revisions meta (or under uploads), and reject paths outside that allowlist.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.