WP Security Header WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.3

Findings

1

Worst severity

high

Content hash

c0922ee743b989f4e7047e0e… Copy

Findings

• high Admin AJAX can change plugin capability role with nonce only

  missing_capability

  prefix_ajax_SecurityHeaderHandle verifies nonce then dispatches update_user_role which update_option('{basename}_user_role', $user_role) without an explicit current_user_can in the AJAX entry. Combined with a compromised low-priv session that obtains the options-page nonce, the required capability for Security Header settings can be lowered.

  admin/ajax/class_wp_security_header_ajax.php:265-273

  Recommendation

  Require manage_options (or the currently configured role) inside every AJAX action; whitelist allowed role strings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.