Oliver Monschau - Customer Backend WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

0.4.8

Findings

2

Worst severity

high

Content hash

bf454896af788fc40a21b3da… Copy

Findings

• high Activation and admin_init grant manage_options to custom kunde role

  insecure_config

  add_customer_role() on activation adds manage_options and edit_theme_options to the 'kunde' role. ensure_menu_access_for_customer() on every admin_init further adds publish/edit_others pages/posts and related caps. Any user assigned kunde receives administrator-equivalent settings power without being an Administrator.

  omonsch-customer-backend.php:19-34

  Recommendation

  Do not grant manage_options to customer roles; use a minimal allowlist of caps and never escalate on admin_init.

• high Remote CDN HTML injected into admin via innerHTML

  xss_stored

  add_custom_admin_banner() file_get_contents a fixed CDN URL and embeds the response into a template literal assigned to customBanner.innerHTML on every admin_notices. Compromised or MITM CDN content becomes stored XSS in wp-admin for all users who see notices. addslashes is not an HTML/JS sanitizer.

  admin-customizations.php:89-101

  Recommendation

  Serve a local escaped banner; if remote, sanitize with wp_kses and avoid innerHTML/template literals.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.