High-severity findings.

Audited release

2.0.0

Findings

1

Worst severity

high

Content hash

688d67b1c6104a2722190b81… Copy

Findings

• high Social publish AJAX missing capability check — any logged-in user can post with site credentials

  missing_capability

  wp_ajax_snn_publish_single_step only calls check_ajax_referer('snn_socials_nonce') then dynamically dispatches publish_to_{platform} using API keys from snn_socials options. There is no current_user_can('manage_options'). Any authenticated user can create a valid snn_socials_nonce and publish to X/LinkedIn/YouTube/etc. using the admin-stored OAuth/API secrets. ajax_test_connection is a stub without auth either.

  snn-socials.php:254-277

  Recommendation

  Require current_user_can('manage_options') immediately after the nonce check; avoid dynamic method dispatch from raw platform strings or whitelist allowed methods.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.