Invintus Media WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

2.0.14

Findings

2

Worst severity

medium

Content hash

3ea913af172c69d908e4a318… Copy

Findings

• medium REST settings write allowed for publish_posts (Author+ can change API keys)

  missing_capability

  The settings CREATABLE route permission_callback returns true for current_user_can('publish_posts'), so Authors and above can call set_settings(), which updates invintus_video_settings including invintus_api_key and invintus_client_id. Observable consequence: a low-privileged author can overwrite the site Invintus API credentials and logging/redirect settings stored in the invintus_video_settings option.

  inc/API.php:403-475

  Recommendation

  Require manage_options (or a dedicated invintus_manage_settings capability) for settings read/write. Keep publish_posts only for content CRUD routes if needed.

• medium REST settings write allowed for publish_posts (Author+ can change API keys)

  missing_capability

  The settings CREATABLE route permission_callback returns true for current_user_can('publish_posts'), so Authors and above can call set_settings(), which updates invintus_video_settings including invintus_api_key and invintus_client_id (plus player preference, public events, watch path, logging). Observable consequence: a low-privileged author can overwrite site Invintus API credentials and redirect/logging settings.

  inc/API.php:403-475

  Recommendation

  Require manage_options (or a dedicated invintus_manage_settings capability) for settings read/write. Keep publish_posts only for content CRUD routes if needed.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.