Dynamic Add Users WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.4

Findings

2

Worst severity

high

Content hash

2d3b1d6995f2de6beb6b1b69… Copy

Findings

• high Directory user/group search AJAX lacks capability and nonce checks

  missing_capability

  wp_ajax_dynaddusers_search_users and wp_ajax_dynaddusers_search_groups call Directory getUsersBySearch/getGroupsBySearch and return display_name + user_email (and group ids) as JSON. Neither handler calls current_user_can nor check_ajax_referer. Any logged-in Subscriber can enumerate directory identities and emails. The Add Users admin page itself requires capability 'administrator', but AJAX does not inherit that gate. Observable: POST action=dynaddusers_search_users&term=a as Subscriber.

  src/DynamicAddUsers/Admin/AddUsers.php:361-394

  Recommendation

  Require current_user_can('create_users') or 'promote_users' and check_ajax_referer before directory queries.

• medium Add Users admin form processes role assignment without CSRF nonce

  csrf

  optionsPage handles POST user/group/role and calls getOrCreateUser + addUserToBlog (including arbitrary role from $_POST['role']) with no wp_nonce_field/check_admin_referer. Page load requires administrator capability via menu, so CSRF needs an admin session. Observable: forged POST to users.php?page=dynaddusers adds LDAP/directory users as administrator.

  src/DynamicAddUsers/Admin/AddUsers.php:92-140

  Recommendation

  Add nonce verification before any addUserToBlog/syncGroup mutation.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.