Doors Promotions WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.20.4

Findings

2

Worst severity

high

Content hash

76c5f06f84f9848a1ff67f86… Copy

Findings

• high admin_post promotion handlers lack capability checks

  missing_capability

  admin_post_submit_promo and related handlers are reachable by any logged-in user but never call current_user_can. Subscribers can create/delete promotions and manage templates.

  doors_promotions.php:857-1132

• medium Unrestricted promo image upload by original filename

  move_uploaded_file uses basename without MIME allowlist under uploads/doors_promotions/.

  doors_promotions.php:872-886

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.