Mailchimp connector WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.0

Findings

2

Worst severity

high

Content hash

ea4185318594bdeacd391c49… Copy

Findings

• high Mailchimp AJAX missing nonce and capability checks

  missing_auth

  ajaxGetSegments and sendTest are registered on wp_ajax_ only (any authenticated user) and perform Mailchimp API calls using the stored API key without check_ajax_referer or current_user_can. A Subscriber can enumerate list segments or trigger test sends.

  src/MetaBox.php:103-140

  Recommendation

  Add check_ajax_referer and current_user_can('edit_posts') or manage_options before any API call.

• low Version mismatch between slug and header

  version_mismatch

  Slug indicates 1.0.5 but plugin header/hashes version is 1.0.0.

  mailchimp-connector.php:1-20

  Recommendation

  Align Version header with release tag.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.