Active Quiz Attempts for LearnDash WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

medium

Content hash

817966766a552e542ed65d78… Copy

Findings

• medium odd_delete_active_quiz_attempt never enforces nonce (CSRF)

  missing_nonce

  The guard is written as (!isset($user_id,$activity_id) && !wp_verify_nonce(...)) || !current_user_can(...). $user_id/$activity_id are always assigned (default 0), so isset() is always true and the && nonce branch never runs. Only the capability check remains. Any site user with wpProQuiz_edit_quiz can be CSRF'd into deleting arbitrary user_activity / user_activity_meta rows. Fix operator precedence and require a valid nonce before delete.

  odd-active-quiz-attempts-for-learndash.php:130-145

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.