World Time AI WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

3.7.3

Findings

3

Worst severity

high

Content hash

782ad4043acc3e5bde56f509… Copy

Findings

• high Unauthenticated transient cleanup via direct PHP entrypoint

  missing_auth

  cleanup-wta-transients.php loads wp-load.php and DELETEs rows matching _transient_wta_% / _transient_timeout_wta_% with no authentication, nonce, or capability check. Documented for EasyCron URL hits, so any unauthenticated visitor can repeatedly wipe WTA transients and stress wp_options.

  cleanup-wta-transients.php:20-80

  Recommendation

  Require a secret cron key (like wp-cron.php) or run only via WP-CLI/Action Scheduler with manage_options; deny HTTP by default.

• medium Unauthenticated queue runner with weak localhost check

  missing_auth

  wp_ajax_nopriv_wta_start_queue_runner starts ActionScheduler_QueueRunner after verifying REMOTE_ADDR is 127.0.0.1/::1/SERVER_ADDR, with nonce intentionally removed. Misconfigured proxies that forward client IP as REMOTE_ADDR—or attackers who can hit the site from the host network—can trigger concurrent AI queue workers.

  includes/class-wta-core.php:673-707

  Recommendation

  Use a signed loopback token/nonce embedded when spawning runners; keep sslverify true.

• low Loopback runner disables TLS verification

  insecure_config

  request_additional_runners posts to admin-ajax with sslverify=>false, enabling MITM on the loopback spawn path on mis-terminated TLS setups.

  includes/class-wta-core.php:640-650

  Recommendation

  Set sslverify true or use an internal CLI/Action Scheduler spawn that never leaves the process.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.