Tecumseh Verhuur WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

0.1.1

Findings

1

Worst severity

medium

Content hash

b4ec06caa314abefb24e4c81… Copy

Findings

• medium Missing CSRF nonce on rental booking submission

  csrf

  handle_scouting_rentals_submission runs on every 'wp' request when submit_rental is POSTed, inserts into scouting_rentals with status pending, and redirects. No wp_nonce_field/check_admin_referer. Attacker can CSRF a logged-in admin or spam bookings as unauth visitor.

  includes/form-handler.php:115-177

  Recommendation

  Add wp_nonce_field to the form and verify with wp_verify_nonce before insert; add rate limiting.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.