Low-severity findings only.

Audited release

3.21.8

Findings

1

Worst severity

low

Content hash

aedbaebfbfbb0f9242651106… Copy

Findings

• low Design tag/collection AJAX handlers missing nonce

  missing_nonce

  MyStyle_Ajax registers wp_ajax_mystyle_design_tag_add/remove and design_collection_add/remove. Only design_access_change calls check_ajax_referer. Tag/collection mutators authorize via DesignManager for the current user but accept CSRF from any page the design owner visits, allowing unauthorized tag/collection modifications on designs the victim can edit.

  includes/class-mystyle-ajax.php:140-250

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.