Medium-severity findings.

Audited release

1.8.0

Findings

1

Worst severity

medium

Content hash

4298f4013fc7d3f0650a2772… Copy

Findings

• medium Members settings page is granted to edit_posts (Contributor+)

  missing_capability

  setup_settings_page() registers a Settings → Members submenu (options-general.php?page=mf_settings) with capability edit_posts rather than manage_options. WordPress will promote that submenu for users who have edit_posts but not the parent Settings cap, so Contributor, Author, and Editor can open the screen. The view itself performs the write: if POST action=set-members-page it check_admin_referer('set-members-page') and update_option('mf_page_for_members', (int) $_POST['page_for_members']). There is no current_user_can('manage_options') re-check in the callback. Subscriber cannot reach it. Observable consequence: a Contributor can retarget the membership front controller to any page ID (or 0). Rewrites::rewrites() and Member_Frontend::render() then replace that page's the_content with login/register/dashboard templates, which defaces a public page and moves or disables the members endpoints. Not XSS; the stored value is an integer page ID.

  classes/class-admin.php:38-46

  Recommendation

  Register the submenu and re-check in the save path with manage_options. Keep check_admin_referer('set-members-page').

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.