Brand Font Manager WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

2.1.0

Findings

1

Worst severity

low

Content hash

8bdbc07b91f562f966588f75… Copy

Findings

• low eval() of premium PHP stored in options after license download

  eval_by_design

  bfm_load_premium_code() decrypts files from option bfm_premium_files (populated via wp_remote_post to vendor API when licensed) and eval()'s the result. AJAX/license paths require manage_options. This is intentional remote-code loading; compromise of the vendor API, MITM, or option write would yield RCE.

  inc/license.php:326-348

  Recommendation

  Prefer shipping premium PHP as signed files on disk verified with a public key, rather than eval of option-stored blobs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.