Medium-severity findings.

Audited release

2.8.1

Findings

1

Worst severity

medium

Content hash

43a557ee9489afe1a2f20fa9… Copy

Findings

• medium Missing nonce on QikRedirection save_post meta write

  missing_nonce

  saveEntry updates _pg_r_url / _pg_r_display from $_POST when current_user_can('edit_post') but never verifies a metabox nonce. An attacker can CSRF an author/editor into setting a 301 redirect URL for a post they can edit, defacing or phishing via template_redirect's wp_redirect($url).

  class/pgredirection.php:118-145

  Recommendation

  Add wp_nonce_field in editEntry and wp_verify_nonce in saveEntry before updating meta.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.