Mars system WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

3.0.0

Findings

2

Worst severity

high

Content hash

ebf835fdc7945033c06b59c2… Copy

Findings

• high Unauthenticated mars/flush_vinaphone deletes transient

  missing_auth

  flush_vinaphone REST route has no ApiKey check and deletes the vinaphone_products transient for any caller.

  includes/api.php:216-224

  Recommendation

  Require authentication and a permission_callback.

• high Authenticated-by-key media_sideload_image enables SSRF

  ssrf

  nhymxu_insert_post passes attacker-controlled image URL to media_sideload_image after only the hardcoded ApiKey check.

  includes/api.php:60-68

  Recommendation

  Allowlist image hosts and validate URLs before sideload.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.