Invision Community Single Logout WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

0.4.1

Findings

1

Worst severity

low

Content hash

ef2d0133ffab3712ae786b26… Copy

Findings

• low Public logout rewrite endpoint enables WordPress logout CSRF

  csrf

  template_redirect handler maybe_log_the_user_out_from_ipb clears Invision cookies on every request and, when the plugin rewrite query var equals 'logout', issues a Location redirect to wp_logout_url('/'). There is no nonce or confirmation. An attacker can lure a logged-in user to visit that URL and force WordPress (and IPB) logout.

  plugin.php:83-90

  Recommendation

  Require a WordPress logout nonce (or POST+nonce) before calling wp_logout_url, and avoid clearing IPB cookies on every template_redirect — only clear them on the intentional logout path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.