Website Tutorials WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.331

Findings

1

Worst severity

medium

Content hash

8878ec7919546f957063e042… Copy

Findings

• medium Any logged-in user can update tutorial notes meta

  wp_ajax_update_notes calls update_post_meta/delete_post_meta for attacker-chosen post_id with only sanitize_textarea_field on notes. No check_ajax_referer and no current_user_can(edit_post). Any subscriber/customer who can POST to admin-ajax.php can modify notes on arbitrary posts.

  index.php:199-220

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.