TCD Glossary WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

2.0.6

Findings

1

Worst severity

medium

Content hash

8a03a50ca504cf0530faf67c… Copy

Findings

• medium Unauthenticated disclosure of arbitrary post type content via tcd_glossary_filter

  information_disclosure

  The nopriv AJAX handler takes post_type from the request and only checks that it exists, then queries all published posts of that type and returns their full rendered content. It is not restricted to the configured glossary post type or to publicly queryable types, and password protection is not honoured, so anonymous visitors can read content of non-public custom post types (for example Flamingo stored messages, reusable blocks, ACF field groups or private CPTs of other plugins) and password-protected posts.

  includes/class-tcd-query.php:64-75,120-128

  Recommendation

  Ignore the request post_type (use the saved setting or a server-side allowlist of public types), require is_post_type_viewable(), and skip posts where post_password_required().

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.