Cloudbeds WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.7.0

Findings

2

Worst severity

high

Content hash

4c4f08b889fcf94c13aec0a9… Copy

Findings

• high Unauthenticated settings write via /cloudbeds/settings/

  missing_capability

  Same pattern: __return_true + wp_rest nonce only, then cloudbeds_set_option('cloudbeds_admin_email', ...).

  src/php/routes.php:47-168

  Recommendation

  Require manage_options in permission_callback.

• medium Public /cloudbeds/data/ dumps secrets given data key

  information_disclosure

  GET /cloudbeds/data/ is public and returns cloudbeds_option_data() including access/refresh tokens and client secret when ?key= matches cloudbeds_data_key. Key is a 30-char secret shown in wp-admin; still a high-value disclosure endpoint if the key leaks.

  src/php/routes.php:34-143

  Recommendation

  Require manage_options or a signed short-lived token; never return client_secret/refresh_token to remote sync consumers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.