JikePress WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.2.1

Findings

1

Worst severity

medium

Content hash

fa58207369ed82f3c6669550… Copy

Findings

• medium Activity upload AJAX missing upload_files capability check

  missing_capability

  wp_ajax_shi_upload_image verifies shi-upload-nonce then calls media_handle_upload without current_user_can('upload_files'). Nonce is localized on BuddyPress activity pages for any visitor context that enqueues scripts while logged in, so roles without upload privilege may still hit the endpoint.

  includes/class-frontend.php:116-143

  Recommendation

  Require current_user_can('upload_files') (or BP equivalent) before handling upload; restrict script localization to capable users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.