High-severity findings.

Audited release

1.4.4

Findings

2

Worst severity

high

Content hash

6b519dfefc4fe119dc4b2fbe… Copy

Findings

• high Active sitewide sale AJAX missing nonce and capability checks

  missing_auth

  wp_ajax_swsales_set_active_sitewide_sale maps to set_active_sitewide_sale(), which reads $_POST['sitewide_sale_id'] and writes SWSales_Settings options (active_sitewide_sale_id) with no wp_verify_nonce and no current_user_can. The accompanying admin JS posts only action and id. Any logged-in user who can hit admin-ajax.php can switch or clear the active sale, changing site-wide banners and sale behavior for all visitors.

  classes/class-swsales-post-types.php:153-164

  Recommendation

  Require current_user_can('manage_options') (or edit capability for the sale CPT) and verify a nonce before saving options.

• medium Landing page creation AJAX lacks capability check

  missing_capability

  create_landing_page_ajax verifies only swsales_create_landing_page nonce then wp_insert_post of a draft page. No current_user_can check. Users who can obtain the nonce from the sale editor can create pages without an explicit capability gate in the handler.

  classes/class-swsales-metaboxes.php:838-888

  Recommendation

  Require current_user_can('publish_pages') or manage_options after nonce verification.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.