Snel 3D Mockup WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.1

Findings

2

Worst severity

high

Content hash

0ec1b389d333ed7602b4134a… Copy

Findings

• high Broken access control: set featured image on arbitrary posts via mockup REST

  missing_capability

  POST /snel-mockup/v1/thumbnail allows any user with edit_posts to upload a PNG and, when setFeatured is true, call set_post_thumbnail($post_id, ...) for an attacker-chosen productId without current_user_can('edit_post', $post_id). An Author can replace featured images on others' products/posts.

  snel-3d-mockup.php:153-208

  Recommendation

  Require current_user_can('edit_post', $post_id) (and upload_files) before attaching or setting the featured image.

• medium Global mockup config/presets writable with edit_posts

  missing_capability

  REST /config and /presets update site-wide options snel_mockup_config and snel_mockup_presets when current_user_can('edit_posts'). Authors can overwrite studio settings for the whole site; prefer manage_options or a dedicated cap, and sanitize the JSON blob.

  snel-3d-mockup.php:121-148

  Recommendation

  Gate config/presets writes behind manage_options (or similar) and validate/sanitize stored structures.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.