Hosting Support Tools WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.0.1

Findings

2

Worst severity

medium

Content hash

2bb45939f41aa8b10560e343… Copy

Findings

• medium flws_refresh_data AJAX missing nonce and capability

  missing_capability

  wp_ajax_flws_refresh_data triggers multiple Cloudways API fetches with force-refresh and has no check_ajax_referer or current_user_can. Any authenticated user can abuse hosting API quota and refresh cached infra metadata.

  flws/dashboard-widget.php:314-337

  Recommendation

  Restrict to manage_options and verify a nonce localized only on the dashboard widget for admins.

• low Dashboard widget exposes hosting identifiers to all dashboard users

  information_disclosure

  wp_add_dashboard_widget registers without capability gating, so any role that sees the dashboard receives server_id, app_id, domain, backup and SafeUpdates status.

  flws/dashboard-widget.php:24-31

  Recommendation

  Show widget only for manage_options (or a custom cap).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.