Lighter LMS WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.0.0-alpha.23

Findings

2

Worst severity

medium

Content hash

f681103925db7f4536b3469d… Copy

Findings

• medium Unauthenticated topic search leaks draft/pending/future course curriculum

  missing_auth

  GET lighter-lms/v1/topics is registered with permission_callback __return_true. get_topics() forwards the caller-supplied status query arg into Topics::search(), and _normalise_statuses() allows publish, trash, draft, future, pending, plus the sentinel any (which expands to all ALLOWED_STATUSES). Unauthenticated callers can enumerate topic keys/titles and course IDs for unpublished courses. Admin mutations correctly require edit_posts/delete_posts; only this read path is open.

  includes/api/topic.php:16-21,127-136

• low Legacy GET /topic search also uses __return_true

  information_disclosure

  includes/api/api.php registers GET /topic with permission_callback __return_true and search_topics() returns normalised topic records (key, title, courseId, sortOrder) for empty or matching queries without any capability or enrollment check. Overlaps the /topics issue; curriculum metadata is publicly enumerable.

  includes/api/api.php:347-352,459-484

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.