High-severity findings.

Audited release

1.5.12

Findings

1

Worst severity

high

Content hash

36e1558d7623a9292ff399df… Copy

Findings

• high Missing CSRF nonce on settings save handler

  csrf

  Even for authenticated admins, dsp_submit_key never verifies a nonce, enabling CSRF to overwrite API credentials if an admin visits an attacker page while logged in.

  admin/admin-options.php:178-216

  Recommendation

  Add wp_nonce_field to the settings form and check_admin_referer in dsp_submit_key.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.