Azure Blob Storage for WordPress WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.4

Findings

2

Worst severity

high

Content hash

494ab80012449718ad1b6f18… Copy

Findings

• high wp_ajax_sync_to_azure missing capability and nonce

  missing_capability

  Any authenticated user (Subscriber+) can POST action=sync_to_azure. Handler builds/uploads the media sync queue to Azure with no current_user_can and no check_ajax_referer, enabling abuse of Azure credentials/bandwidth and media exfiltration to the configured container.

  azure-blob-storage.php:306-339

  Recommendation

  Require current_user_can('manage_options') and check_ajax_referer before processing.

• medium clear-azure-queue via admin_init without capability or nonce

  csrf

  admin_init deletes sync/delete/upload queues when $_GET['clear-azure-queue'] is set, with no capability or nonce check — CSRF against any user who can hit wp-admin.

  azure-blob-storage.php:342-352

  Recommendation

  Gate with manage_options + check_admin_referer.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.