Doors Frames WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.26.7

Findings

3

Worst severity

high

Content hash

56edc363903b372351d64528… Copy

Findings

• high Missing capability and nonce on WooCommerce price/status AJAX handlers

  missing_capability

  Multiple wp_ajax_* handlers in frames_list_page.php (update_product_price, change_product_status, delete_frame, update_frame_prices, mass_insert_frames, paste_frames, activate_*, etc.) perform privileged WooCommerce/product DB writes with no current_user_can() and no nonce verification. Any authenticated user (Subscriber+) can change prices, flip post_status, delete frame rows, or mass-update pricing.

  pages/frames_list_page.php:565-1680

• high Unauthenticated REST endpoint creates draft WooCommerce products

  missing_permission_callback

  register_rest_route woo-external-cart/v1/add-to-cart uses permission_callback __return_true and wp_insert_post() to create draft products with attacker-controlled title/content/price, then adds them to cart and sets customer session data. Unauthenticated callers can spam product creation and inject cart contents.

  pages/external_cart.php:35-120

• medium Missing nonce on privileged AJAX handlers

  missing_nonce

  Same price/frame mutation handlers lack wp_verify_nonce/check_ajax_referer, enabling CSRF against any logged-in victim who can reach admin-ajax.php.

  pages/frames_list_page.php:565-700

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.