Wordpress Iterable Add-On WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

4.4.2

Findings

3

Worst severity

high

Content hash

217528792c5f357c50a3efc4… Copy

Findings

• high Unauthenticated getchannels/updatechannel AJAX uses site Iterable API key

  missing_auth

  Handlers registered on both wp_ajax_ and wp_ajax_nopriv_ for getchannels and updatechannel perform no nonce, capability, or identity check. They instantiate WP_Iterable(get_option('api_key')) and call user()/user_update_subscriptions with attacker-controlled $_REQUEST['email'] and ids. Unauthenticated callers can enumerate channel unsubscribe state for any email and force subscription changes via the site's API key.

  index.php:185-229

  Recommendation

  Require a signed preference-center token bound to the email, or at least is_user_logged_in + ownership proof + nonce. Never expose getchannels/updatechannel as nopriv without strong email verification. Remove nopriv registration if not needed for public preference centers.

• high Logged-in users can save/delete Iterable feeds and read Gravity Forms without capability checks

  missing_capability

  wp_ajax_saveiterablefeed, wp_ajax_deleteiterablefeed, and wp_ajax_gravityformfieldsbyid have no current_user_can or nonce verification. Any authenticated Subscriber can dump Gravity Forms field structures and create/update/delete Iterable feed configuration stored by IterableData.

  index.php:474-500

  Recommendation

  Gate these AJAX actions behind manage_options (or gform_full_access) and check_ajax_referer tied to the admin UI.

• medium wp_ajax_subscribe imports subscribers without capability check

  missing_capability

  Authenticated subscribe AJAX calls import_users() using the site API key with no capability or nonce check, allowing any logged-in user to push arbitrary subscriber payloads into Iterable lists.

  index.php:324-327

  Recommendation

  Restrict to manage_options and verify an admin nonce; reject non-admin roles.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.