Medium-severity findings.

Audited release

1.0.7

Findings

2

Worst severity

medium

Content hash

70d6abaa3b6323bb56da35e2… Copy

Findings

• medium Any logged-in user can add tags to any post (no nonce, no capability)

  missing_capability

  wp_ajax_add_tags_ajax_handler calls wp_set_post_tags() on an arbitrary post_id with arbitrary tags without check_ajax_referer or current_user_can('edit_post'). Subscribers can modify taxonomy of any post (including creating new terms), and the action is CSRF-able against logged-in users.

  admin/class-openai-blog-writer-admin.php:414-425

  Recommendation

  Add check_ajax_referer and current_user_can('edit_post', $post_id); sanitize post_id with absint.

• low Tag generation AJAX lacks capability check

  missing_capability

  generate_tags_ajax_handler checks a nonce but not current_user_can('edit_post'), and logs model output with error_log.

  admin/class-openai-blog-writer-admin.php:388-402

  Recommendation

  Require edit_post on the target post; remove debug error_log calls.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.