Coffer WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

medium

Content hash

3e648d9a140ae5ebd5b08e76… Copy

Findings

• medium Unauthenticated Stripe PaymentIntent create/update without nonce

  missing_auth

  wp_ajax_nopriv_create_payment_intent and update_payment_intent use the site's Stripe secret key with no nonce or rate limit. Attacker can create/update intents (amount concatenated as string+00; filter_var result discarded so non-numeric amounts may error or behave oddly). Blast radius: Stripe API abuse/cost and payment-flow tampering, not RCE or WP privilege escalation.

  inc/class-donate.php:24-120

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.