Ruh Comment WP Registry grade B-. Medium-severity findings · 4 findingsWP RegistryMedium-severity findings · 4 findingsOpen the reportB-

Medium-severity findings.

Audited release

8.0

Findings

4

Worst severity

medium

Content hash

8912785ad2fb544a058880b5… Copy

Findings

• medium Unauthenticated user search AJAX discloses user_login values

  information_disclosure

  ruh_search_users is registered nopriv and returns user_login, display_name, and avatar for matching users after only a comment nonce. Enables username enumeration for login attacks.

  includes/advanced-features.php:18-75

  Recommendation

  Require login; return only display_name (not user_login); rate-limit searches.

• medium Logged-in users can upload media without upload_files capability

  missing_capability

  ruh_handle_image_upload only checks is_user_logged_in() and a nonce, then media_handle_upload(). Subscribers without upload_files can inject attachments into the Media Library.

  includes/auth-handler.php:393-450

  Recommendation

  Require current_user_can('upload_files') before media_handle_upload.

• medium Unauthenticated user search AJAX discloses user_login values

  information_disclosure

  wp_ajax_nopriv_ruh_search_users is registered. ajax_search_users only check_ajax_referer('ruh-comment-nonce') then get_users() with search on user_login/display_name and returns id, username (user_login), display_name, avatar, level. The comment nonce is available to anonymous visitors on pages with the comment UI, enabling username enumeration for credential stuffing.

  includes/advanced-features.php:18-75

  Recommendation

  Require is_user_logged_in() for user search; return only display_name (not user_login); rate-limit aggressively.

• medium Logged-in users can upload media without upload_files capability

  missing_capability

  ruh_handle_image_upload (wp_ajax_ruh_upload_image) checks is_user_logged_in and nonce, validates MIME/size, then media_handle_upload('image', 0) without current_user_can('upload_files'). Default Subscribers lack upload_files; this creates Media Library attachments for any authenticated role, expanding attack surface for stored content and disk use.

  includes/auth-handler.php:393-446

  Recommendation

  Require current_user_can('upload_files') or a dedicated capability; or store avatars outside the Media Library with stricter validation.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.