High-severity findings.

Audited release

11.0.0

Findings

3

Worst severity

high

Content hash

5985c507206c69fd18d07f55… Copy

Findings

• high Password reset and email-code endpoints disclose user email addresses

  information_disclosure

  requestPasswordReset returns "Password reset link send to $email" including the full mailbox. requestEmailCode returns "E-mail sent to " . $user->user_email. Both are public (__return_true). Combined with username enumeration (Invalid username vs success), attackers harvest emails for phishing and confirm account existence.

  php/rest_api.php:368-396

  Recommendation

  Always return a generic success message regardless of whether the user exists, and never echo the destination email.

• high Logged-in users can remove arbitrary WebAuthn user-handles (IDOR)

  missing_capability

  remove_web_authenticator is callable by any user with the read capability. removeWebAuthenticator() takes $_POST['userHandle'] and unsets that key from the site option tsjippy-webauth-user-handles with no check that the handle belongs to the current user. A Subscriber can disrupt other users' passwordless/passkey login mappings.

  php/rest_api_biometrics.php:162-178,207-219

  Recommendation

  Scope removals to credentials owned by get_current_user_id(), verify the posted key against that user's stored WebAuthn records, and require a nonce.

• medium Password reset and email-code endpoints disclose user email addresses

  information_disclosure

  requestPasswordReset returns "Password reset link send to $email" and requestEmailCode returns "E-mail sent to " . $user->user_email for a supplied username/id. Unauthenticated callers can enumerate valid usernames and recover associated emails.

  php/rest_api.php:368-396

  Recommendation

  Return a generic success message that does not include the destination email or confirm whether the username exists.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.