News Block WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.6.2

Findings

2

Worst severity

medium

Content hash

2b3c7769c988681dda67ccd3… Copy

Findings

• medium Public REST site/taxonomy enumeration on multisite

  information_disclosure

  Multiple routes under schrauger/news-block/v1 (get-sites, get-post-types, get-taxonomies, get-terms, including /site/{blog_id}/...) use permission_callback __return_true. get_sites_list returns network site list to unauthenticated callers — information disclosure useful for recon.

  news-block-endpoint.php:29-36

• low REST routes use __return_true without in-handler auth

  missing_permission_callback

  All news-block REST routes set permission_callback to __return_true. Handlers are read-only metadata but still expand attack surface.

  news-block-endpoint.php:29-180

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.