High-severity findings.

Audited release

2.0.1

Findings

1

Worst severity

high

Content hash

17259b6f38db377e6086feb0… Copy

Findings

• high Missing capability on u3a settings admin_post handlers

  missing_capability

  save_general_settings / save_group_settings / save_venue_settings / save_event_settings are hooked to admin_post_* and only call check_admin_referer('u3a_settings'). Any logged-in user can mint that nonce via wp_create_nonce and POST to admin-post.php to update_option('blogname', ...) and other u3a_* options. Settings UI itself requires manage_options to view, but handlers do not re-check capability.

  classes/class-u3a-admin.php:379-394

  Recommendation

  Add current_user_can('manage_options') (or the same cap used for the settings menu) immediately after the nonce check in every save_*_settings handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.