CMS-Workflow WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

2.1.0

Findings

1

Worst severity

high

Content hash

88b81c329948bbc6ca4b140f… Copy

Findings

• high Direct xliff-download.php discloses post content to any logged-in user

  information_disclosure

  Bootstraps wp-load.php then only checks is_user_logged_in(); no edit_post. Subscriber can fetch XLIFF with title/body/excerpt when translation metas present.

  includes/Modules/Translation/xliff-download.php:1-45

  Recommendation

  Require edit_post; use admin-ajax with nonce; remove direct wp-load bootstrap.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.