Importer for Polarsteps WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

medium

Content hash

7033d8c9a03de796de5c4f7e… Copy

Findings

• medium Unauthenticated forced import and post publication (missing auth/nonce)

  missing_auth

  The same actions() dispatcher lets any visitor trigger ?action=get_steps (outbound import from Polarsteps and DB writes) and ?action=generate_post (Generator::store(true) -> wp_insert_post with post_status 'publish'), forcing publication of a blog post from pending steps on the attacker's schedule and enabling repeated resource-consuming imports.

  admin/class-polarsteps-integration-admin.php:453-479

  Recommendation

  Require manage_options and a nonce for these actions and register them only in admin context.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.