Profile Migrator WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

2.4.0

Findings

3

Worst severity

high

Content hash

92a707e3e5259bff1053d174… Copy

Findings

• high Unauthenticated (any logged-in user) multisite DB conversion AJAX

  missing_auth

  ajax_site_quick_convert and ajax_site_ranged_convert read site_id from $_POST and run alter_post_type/alter_post_taxonomy/alter_shortcode_references/alter_acf_references with no check_ajax_referer and no current_user_can. Any Subscriber can POST to admin-ajax.php and rewrite post types across the network.

  profile-migrator.php:752-762

• high Site enumeration AJAX without capability check

  missing_capability

  ajax_get_sites returns all network sites and profile counts with no nonce or capability gate.

  profile-migrator.php:721-732

• medium Missing nonce on all profile-migrator AJAX handlers

  missing_nonce

  None of the four wp_ajax handlers call check_ajax_referer/wp_verify_nonce, enabling CSRF against any logged-in session.

  profile-migrator.php:721-793

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.