AI Avatar Buddy for WordPress WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.6

Findings

1

Worst severity

high

Content hash

9241408d59def460124b54e8… Copy

Findings

• high Public REST chat endpoint proxies requests with site API key

  missing_permission_callback

  register_rest_route for ai-avatar-buddy/v1/chat uses permission_callback __return_true. handle_chat_request reads the site's api_key/api_url from options and forwards attacker-controlled prompts to the LLM provider. Unauthenticated visitors can exhaust API quota, incur charges, or abuse the outbound HTTP client. No rate limiting observed.

  ai-avatar-buddy.php:232-300

  Recommendation

  Require a capability or signed short-lived token, add strict rate limiting per IP/session, and optionally restrict to logged-in users. Do not expose raw API proxying without quotas.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.