Sage API Connection to ROI Consulting WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

4.0.6

Findings

1

Worst severity

high

Content hash

619bf099ec8bc3f23d9deb65… Copy

Findings

• high Customer search AJAX missing capability (PII enumeration)

  information_disclosure

  sage_roi_customer_search is registered for wp_ajax_ and wp_ajax_nopriv_. Auth is only sage_roi_nonce_get_check(). The nonce is localized on admin_enqueue_scripts for every admin page view (no capability gate on enqueue), so any logged-in user who loads /wp-admin/ can scrape sage_roi_var.nonce and query WP_User_Query for role=customer matching name/email/phone/address meta, returning customer IDs and names. No current_user_can check.

  ajax.php:19-106

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.