JP Subscribe DB WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.2.0

Findings

2

Worst severity

high

Content hash

ba9c312e092676288dd85533… Copy

Findings

• high Unauthed capability on subscriber CSV export AJAX

  information_disclosure

  wp_ajax_jp_subscribers_csv_export dumps the entire wp_subscribers table (names/emails) as a CSV download with no current_user_can() and no nonce check. Any logged-in user can exfiltrate the subscriber list.

  jp-subscribers.php:165-210

• low Raw SQL interpolation of email in add_subscriber

  unsafe_input

  subscriber_email is interpolated into SQL after FILTER_SANITIZE_STRING and is_email(). Not practically exploitable under wp_magic_quotes + is_email, but should use $wpdb->prepare.

  includes/class-subscribers.php:44-48

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.