Universal Multilingual WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.21.0

Findings

1

Worst severity

low

Content hash

bcf978585cd841851d0c0e5c… Copy

Findings

• low Classic translation save handler lacks per-post edit_post check

  missing_capability

  Editor::handle_save() (admin_post_aiml_save_translation) checks only current_user_can('aiml_translate') and a nonce, then saves translations for whatever post_id is posted, including posts the user cannot edit. The REST workspace equivalent enforces current_user_can('edit_post', $post_id). By default only administrators and editors hold aiml_translate, so impact is limited to sites that grant the capability to restricted translator roles.

  src/Admin/Editor.php:150-200

  Recommendation

  Add current_user_can('edit_post', $post_id) before saving, matching WorkspaceController::can_edit_post().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.