Medium-severity findings.

Audited release

1.2.2

Findings

1

Worst severity

medium

Content hash

df3585f68176abcb14719a72… Copy

Findings

• medium Predictable sequential contact_id enables recipient enumeration and spam

  predictable_token

  u3a_contact shortcode creates rows with auto-increment ids and links to /u3a-contact-form?contact_id=N. The 'nonce' column is unused and hardcoded to 123456. An unauthenticated attacker can probe sequential IDs while records exist (cleared after ~2 days) to open the form for any recently linked recipient and send them mail — defeating the anti-spam design that hides emails.

  class-u3a-contact-form-table.php:40-75

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.