Omni WP API WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.1.8

Findings

1

Worst severity

medium

Content hash

5dfe90b14263e4325e1198bd… Copy

Findings

• medium create_project_action and sync_data_ajax_handler missing current_user_can

  missing_capability

  Both handlers only call check_ajax_referer then mutate Omni project/sync state via the API and update_option paths. Any authenticated user who obtains the admin-localized nonce can create projects or sync content without manage_options. Settings page rendering checks manage_options but the AJAX entry points do not re-check.

  src/Admin/ClassAdmin.php:578-596

  Recommendation

  Require current_user_can('manage_options') immediately after the nonce check.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.