Tangible Blocks WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

4.3.3

Findings

1

Worst severity

low

Content hash

a84fc5049c5309c815f2354a… Copy

Findings

• low Post/user select AJAX lacks capability check

  missing_capability

  Legacy post-select and user-select actions are registered via the framework's logged-in ajax add_action which only verifies the shared tangible_ajax nonce. Any logged-in user holding that nonce can list titles of posts of any status/post_type (drafts, private) and user display names/IDs by role. Code comment acknowledges the missing check.

  includes/legacy/controls/aliases/post-select.php:9-45

  Recommendation

  Require edit_posts (or builder-specific capability) and restrict to readable statuses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.