TDWS Product Inventory List WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.6

Findings

1

Worst severity

high

Content hash

a64c19847a6024d5674190c1… Copy

Findings

• high Missing capability on nopriv product meta update AJAX

  tdws_save_web_link and tdws_save_web_link_by_file are hooked to wp_ajax_nopriv_* and only verify tdwsCustomNonce before update_post_meta(post_id, tdws_web_link, ...). The nonce is localized via admin_enqueue_scripts for any admin screen (including profile.php), so any authenticated user who can load wp-admin can obtain a nonce and overwrite vendor links on arbitrary products. CSRF against higher-privileged sessions is also possible.

  tdws-product-inventory-list.php:151-186

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.