WP Events WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.5.2

Findings

1

Worst severity

high

Content hash

35d3584b9163c22aeb414f4f… Copy

Findings

• high GET /dates list also lacks permission_callback

  missing_permission_callback

  The collection GET route registers without permission_callback, exposing all event dates to unauthenticated callers (information disclosure depending on data sensitivity).

  src/Rest/RestDates.php:45-49

  Recommendation

  Add an explicit permission_callback (public __return_true only if intentional, otherwise edit_posts).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.