BudgetBuddy WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.1

Findings

1

Worst severity

medium

Content hash

78d86265395ff7ea07f2cec2… Copy

Findings

• medium CSRF on plan status update and delete (missing nonce)

  csrf

  budget-logic.php, included for logged-in users, processes $_POST['bb_update_plan_status'] and $_POST['bb_delete_plan'] with only is_user_logged_in(). There is no wp_verify_nonce/check_admin_referer. A malicious page can CSRF a logged-in BudgetBuddy user to change or delete their own plans (bb_update_plan_status scopes by user_id).

  includes/budget-logic.php:21-32

  Recommendation

  Require check_admin_referer or wp_verify_nonce on these POSTs (same nonce already used for AJAX plan ops).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.