High-severity findings.

Audited release

1.2.10

Findings

2

Worst severity

high

Content hash

27389d85caee079d190e0d7d… Copy

Findings

• high nopriv AJAX reads arbitrary post meta

  information_disclosure

  handle_get_post_meta is also nopriv with nonce-only auth and returns get_post_meta for any post_id/meta_key, disclosing private post meta to callers who obtain the localized nonce.

  inc/utils/class/class-ajax.php:24-44

  Recommendation

  Require authentication and edit_post (or read_private_posts) before returning meta; whitelist keys.

• high nopriv AJAX schedules manual HTML email campaigns

  missing_capability

  handle_set_cron_email is nopriv, nonce-only, and passes subject/userEmail/date/content/template into CronNew::set_Manually_Mail, enabling unauthenticated/low-priv users to schedule emails with attacker HTML content to chosen recipients (spam/phishing).

  inc/utils/class/class-ajax.php:73-108

  Recommendation

  Restrict to manage_options; sanitize/kses email HTML; remove nopriv.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.