Sexpert WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

0.0.1

Findings

3

Worst severity

high

Content hash

1bf223c8900df3a51b100f1f… Copy

Findings

• high Unauthenticated comment endpoint emails assignee

  missing_auth

  comment() inserts attacker-controlled comment text and emails the assignee with no authorization check. Route has no permission_callback.

  api/comment.php:3-52

  Recommendation

  Gate with permission_callback and staff capability; sanitize comment; rate-limit.

• high REST routes missing permission_callback (public by default)

  missing_permission_callback

  setup_restful() registers 14 routes without permission_callback. Since WP 5.5 this publicly exposes callbacks; several rely only on incomplete authorize() or have no checks.

  sexpert.php:124-180

  Recommendation

  Add explicit permission_callback to every route; default-deny.

• medium Public get_config discloses mail templates and settings

  information_disclosure

  GET /sexpert/v1/config returns full config row including email titles/bodies and disclaimer with no auth.

  api/sexpert-status.php:15-22

  Recommendation

  Restrict config read to administrators.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.