NDLA's H5P Extractor WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.2.3

Findings

1

Worst severity

medium

Content hash

ad02689d330d84e1f70a7ca2… Copy

Findings

• medium H5P extract AJAX lacks capability check — solutions and export writes for any logged-in user

  missing_capability

  wp_ajax_ndlas_h5p_extractor_extract is registered without a current_user_can gate. handle_request only verifies nonce action ndlas_h5p_extractor (which any authenticated user can mint, and which is also printed into front-end localized script on H5P pages). It then loads H5P content by contentId, may call create_h5p_export (writes export under uploads/h5p/exports and updates content filtered/slug fields), and returns representation plus solution JSON. A Subscriber can harvest quiz answers and trigger export generation.

  includes/class-request-handler.php:26-57

  Recommendation

  Require an appropriate capability (e.g. edit_posts or a dedicated H5P capability) in addition to the nonce; do not localize the admin AJAX nonce to anonymous front-end viewers if extraction should be editor-only; gate create_h5p_export behind the same check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.