TheoSumma For Ministries WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.11

Findings

1

Worst severity

high

Content hash

42aedf5b3a2a1bf40230cecc… Copy

Findings

• high Low-privilege users can mint Theosumma API JWT via /tsfm/v1/auth

  Auth::is_admin_route() returns false, so permission is only wp_verify_nonce(X-WP-Nonce, wp_rest) with no current_user_can. execute() returns TokenManager::fetch_jwt_token() — a JWT HMAC-signed with the configured API key. Subscribers who can obtain a wp_rest nonce receive a service credential.

  RESTApi/Auth.php:24-53

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.