Mai Demo Importer WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.2.0

Findings

2

Worst severity

high

Content hash

9f4ac5bb3d9b98e5993862ad… Copy

Findings

• high merlin_child_theme AJAX missing authz/nonce — theme write + switch

  missing_capability

  wp_ajax_merlin_child_theme → generate_child() has no check_ajax_referer and no current_user_can. Any logged-in user can mkdir under themes, write style.css/functions.php via WP_Filesystem, update allowedthemes, and switch_theme to the child. High impact site takeover vector for subscriber+.

  includes/merlin/class-merlin.php:1349-1405

• medium merlin_update_selected_import_data_info / import_finished lack nonce and caps

  missing_capability

  Both wp_ajax handlers accept requests from any authenticated user without nonce or capability checks. Impact is lower (import info HTML / transient delete) but expands Merlin attack surface.

  includes/merlin/class-merlin.php:2356-2405

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.