Bookmark Manager WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.1.1

Findings

1

Worst severity

medium

Content hash

9000093fdcbd8d7ada0d900d… Copy

Findings

• medium Subscriber can add/remove Carbon Fields sidebars with no capability or nonce

  missing_capability

  Composer autoload always includes vendor/carbon-fields/carbon-fields.php, which constructs Helper and Sidebar_Manager::instance() on every request. That registers wp_ajax_carbon_add_sidebar and wp_ajax_carbon_remove_sidebar. action_handler() reads $_POST['name'] and calls add_sidebar()/remove_sidebar(), which update_option('carbon_custom_sidebars', ...), with no current_user_can, no check_ajax_referer, and no nopriv (so any logged-in user, including Subscriber). widgets_init later register_sidebar() for each stored entry. Observable: a Subscriber POST to admin-ajax.php?action=carbon_add_sidebar&name=attacker injects a sidebar; CSRF of any logged-in session does the same because there is no nonce. Limited blast (widget area registration, not site takeover) so medium.

  vendor/carbon-fields/core/Manager/Sidebar_Manager.php:42-133

  Recommendation

  Do not boot Carbon Fields Sidebar_Manager if this plugin does not use sidebar fields, or add current_user_can('edit_theme_options') plus check_ajax_referer to both AJAX actions before update_option. Upgrade the bundled Carbon Fields 1.5 library, which is unmaintained.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.