MILG0IR Store Design & Features WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

0.0.6

Findings

1

Worst severity

low

Content hash

3f63afc603c5e18031123860… Copy

Findings

• low Wishlist AJAX handlers missing nonce (CSRF)

  csrf

  mg_add_to_wishlist_ajax, mg_remove_from_wishlist_ajax, and mg_check_wishlist_ajax are wp_ajax-only and gate on get_current_user_id() but never call check_ajax_referer/wp_verify_nonce. A logged-in customer visiting an attacker page can have wishlist entries added/removed via forged POSTs to admin-ajax.php.

  milg0ir-store-design-features.php:594-678

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.