Tsjippy Querier WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

10.6.6

Findings

1

Worst severity

medium

Content hash

7d172647d37c92b9a42b10f0… Copy

Findings

• medium Document removal can delete library attachments and overwrite options for low-privilege users

  missing_capability

  removeDocument() (REST remove-document) is reachable by non-admins: removeDocumentPermissions() returns true when the requester supplies a 'metakey' whose stored value for their own user matches the URL. The handler then trusts $_POST['libraryid'] to wp_delete_attachment() and, when user-id is non-numeric, calls update_option($baseMetaKey, $metaValue) with an attacker-chosen option name — permitting deletion of arbitrary media attachments and clobbering of arbitrary options once the per-file nonce/ownership gate is satisfied.

  shared-functionality/modules/fileUpload/php/rest-api.php:114-160

  Recommendation

  Verify the libraryid actually belongs to the user's stored meta before deleting, and never call update_option() with a client-supplied key; restrict generic-document handling to users with manage_options.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.