API Maker WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.0

Findings

2

Worst severity

high

Content hash

204d372a94e73b07d34f6ace… Copy

Findings

• high Custom REST endpoints default to unauthenticated access and execute named PHP functions

  missing_permission_callback

  ApiEndpoints registers each active api_endpoint CPT as a Plubo REST route whose callback invokes an admin-chosen PHP function. Plubo's Endpoint constructor defaults permission_callback to __return_true, and this plugin never overrides it. JWT is optional middleware. PhpValidator blocks a fixed list of dangerous functions but still allows WordPress state APIs (update_option, wp_insert_user, etc.). Any published/active endpoint without JWT is therefore callable by unauthenticated visitors and runs server-side PHP with the site's privileges.

  Functionality/ApiEndpoints.php:165-178

  Recommendation

  Default permission_callback to current_user_can('manage_options') or require JWT middleware for all non-public endpoints; expand the forbid-list to WordPress mutation APIs; refuse to activate endpoints that lack an explicit auth middleware.

• medium Open CORS (*) applied to all API Maker endpoints by default

  insecure_config

  add_middlewares always attaches Cors('*', ...) unless filtered off, allowing any origin to call potentially state-changing custom endpoints from a browser.

  Functionality/ApiEndpoints.php:81-85

  Recommendation

  Default CORS to the site origin or require admins to opt into wildcard CORS; never combine Cors('*') with unauthenticated write methods.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.