High-severity findings.

Audited release

0.1.3

Findings

2

Worst severity

high

Content hash

1f92aa0cb862050a644e7776… Copy

Findings

• high REST API Tester spoofs arbitrary WordPress users on REST requests

  auth_bypass

  On rest_api_init, maybe_spoof_user accepts HTTP_X_REST_API_USER (integer user ID). After check_admin_referer('mtrat','mtrat-nonce'), it wp_set_auth_cookie/wp_set_current_user to that user and overwrites HTTP_X_WP_NONCE with a fresh wp_rest nonce. The admin UI sends the Tools-page mtrat-nonce and selected user ID with every test request. Anyone who can use this page can invoke REST routes as any account (including administrators). This is unsafe to leave active on production.

  src/Nonce.php:47-84

  Recommendation

  Remove from production sites; if retained for staging, require manage_options, restrict spoof targets, and disable outside WP_DEBUG. Prefer Application Passwords over cookie spoofing.

• medium Dev REST tester localizes full get_users() list into admin JS

  dev_tool_in_production

  Scripts::localize_data embeds get_users() into the page state for the tester UI, exposing all user accounts to anyone who can load the Tools page.

  src/Scripts.php:88-96

  Recommendation

  Do not ship on production; if needed, load a minimal user id/login list for users the current admin may impersonate.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.