High-severity findings.

Audited release

4.2.3

Findings

2

Worst severity

high

Content hash

e5390506f442516781108477… Copy

Findings

• high AJAX login returns json_encoded WP_User including password hash

  information_disclosure

  gears_login_form_submit calls wp_signon() then die(json_encode($signon)). On success $signon is a WP_User whose public $data object includes user_pass. The AJAX response leaks the password hash to the browser, enabling offline cracking.

  modules/login-form/login-form.php:6-18

  Recommendation

  Return only a minimal success payload; never serialize WP_User/user_pass to the client. Add a login nonce.

• low Login AJAX lacks nonce (CSRF login)

  missing_nonce

  gears_login_form_submit is registered for nopriv without check_ajax_referer.

  modules/login-form/login-form.php:2-16

  Recommendation

  Verify a login-form nonce before calling wp_signon().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.