Podlove Beta Tester WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.0.3

Findings

2

Worst severity

high

Content hash

b4fa0c14f5dffec70f2c1f32… Copy

Findings

• high Missing capability and CSRF on beta branch switch

  missing_capability

  handle_settings_request runs on admin_init and switches/leaves plugin update branches based solely on $_GET action/plugin/branch. There is no current_user_can(activate_plugins) check and no nonce. Any authenticated user who can load a wp-admin screen (e.g. profile.php) can trigger switch_branch/leave_branch/reload_config, causing plugin file backup/replace via filesystem copy — integrity and potential supply-chain compromise of Podlove plugins.

  inc/settings.php:120-160

  Recommendation

  Require current_user_can(activate_plugins) and verify a nonce before switch_branch/leave_branch/reload_config. Prefer admin-post handlers over bare admin_init GET.

• high CSRF on Podlove beta branch actions

  csrf

  The same GET-driven handle_settings_request has no CSRF token. An attacker can lure any logged-in user (including low-privilege accounts that can open wp-admin) to flip beta branches.

  inc/settings.php:120-160

  Recommendation

  Add check_admin_referer for each branch action.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.