High-severity findings.

Audited release

1.14.0

Findings

1

Worst severity

high

Content hash

8945c7984f8bc447a80af9e2… Copy

Findings

• high Unauthenticated release webhook creates published posts without signature verification

  missing_auth

  wp_ajax_nopriv_post_newest_release is registered for unauthenticated callers. mudlet_post_release() json_decodes $_POST['payload'] and, for major non-prerelease tags, calls wp_insert_post() / updates existing posts with attacker-controlled title/body/excerpt. No GitHub webhook secret, HMAC, capability, or nonce check exists. Any visitor can publish or update release posts.

  mudlet-release.php:34-120

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.