Hozio Pro WP Registry grade B-. Medium-severity findings · 3 findingsWP RegistryMedium-severity findings · 3 findingsOpen the reportB- #6 in Page Builder Addons

Medium-severity findings.

Audited release

4.21.1

Findings

3

Worst severity

medium

Content hash

82d06d7b21c501a29ac51d26… Copy

Findings

• medium Authors can overwrite or delete any attachment's file (no per-attachment authorization)

  missing_capability

  replace-media only checks upload_files and get_post($attachment_id); it never verifies edit_post on the target attachment. Any Author can overwrite the file of media owned by administrators (in-place move_uploaded_file over get_attached_file()) or, with new_filename, unlink the original file and repoint _wp_attached_file, defacing site-wide images.

  includes/class-media-replace-endpoint.php:122-176

  Recommendation

  Require current_user_can('edit_post', $attachment_id) and confirm the post is an attachment before modifying files.

• medium [leads_digest] shortcode exposes all captured leads to any logged-in user

  information_disclosure

  The documented front-end [leads_digest] shortcode (intended for a 'leads-page') only checks is_user_logged_in() before loading up to 500 leads from wp_hozio_leads and Elementor submissions (name, email, phone, referer, all form fields). On sites with open registration (or WooCommerce customer accounts) any subscriber/customer can read every lead.

  includes/leads-digest.php:2521-2531

  Recommendation

  Gate the shortcode with a real capability (e.g. manage_options or a dedicated view_leads capability assigned to the client role).

• low Main settings save handler relies on nonce only (no capability check)

  missing_capability

  admin_post_hozio_save_settings (hozio_dynamic_tags_save_settings) verifies the hozio_save_settings_nonce nonce but never calls current_user_can() before updating many site options (company address, contact emails, business hours, etc.). The nonce is only rendered on the manage_options settings page, so exploitation requires a leaked nonce; defense-in-depth gap.

  includes/admin-settings.php:3110-3113

  Recommendation

  Add if ( ! current_user_can( 'manage_options' ) ) wp_die(); at the start of the handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.