Pronamic Forms WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

2.1.0

Findings

1

Worst severity

high

Content hash

c31e3aa9ead196c83e2e6f0f… Copy

Findings

• high All form submissions readable by unauthenticated users via core REST API

  information_disclosure

  Submissions are saved by wp_insert_post() as post_type 'pronamic_submission' with post_status 'publish', and the post type is registered with show_in_rest => true. WordPress core REST allows anyone to read published posts of any show_in_rest post type regardless of 'public' => false, so /wp-json/wp/v2/pronamic_submission lists every entry. The stored post_content is the serialized form block with each field's submitted value written into attrs and into the input's value attribute, so content.rendered exposes all submitted personal data.

  psr-4/FormSubmissionProcessor.php:72-86

  Recommendation

  Store submissions with a non-public status (e.g. 'private' or a custom registered status), register the post type with a dedicated capability_type and/or show_in_rest => false, and restrict REST reads with a custom controller requiring edit_posts.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.