TMSM Aquos Spa Booking WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

2.5.4

Findings

1

Worst severity

medium

Content hash

0fc36c08cb9923651ac022c3… Copy

Findings

• medium Add-to-cart AJAX missing nonce verification

  missing_nonce

  ajax_addtocart (wp_ajax and nopriv) reads $_POST[nonce] but never calls wp_verify_nonce/check_ajax_referer, unlike sibling handlers that use ajax_checksecurity(). Enables CSRF add-to-cart of spa appointments.

  public/class-tmsm-aquos-spa-booking-public.php:787-860

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.