RIESTERWP Core WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

0.12.0

Findings

1

Worst severity

low

Content hash

9c29e3a208c0f4900995274b… Copy

Findings

• low Production scaffold: public example AJAX and REST calc route

  unnecessary_attack_surface

  RWP\Ajax\Ajax registers wp_ajax_nopriv_your_method returning a static success payload, and RWP\Rest\Example registers GET /wp-json/wp/v2/calc without permission_callback. Both are loaded when Components detects ajax/rest requests. Blast radius is low (no state change / absint math only) but expands attack surface and pollutes the core wp/v2 namespace.

  includes/core/ajax/Ajax.php:33-49

  Recommendation

  Remove or disable Example/Ajax scaffolding in production builds; if kept, add permission_callback and avoid the wp/v2 namespace.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.