Subscriptions WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

high

Content hash

3fdec5200aec46deaaaafb3a… Copy

Findings

• high Unauthenticated paymentSuccessCallback marks any subscription ready to invoice

  missing_auth

  paymentSuccessCallback_function is hooked to wp_ajax and wp_ajax_nopriv with no nonce, capability, payment-gateway signature, or ownership check. Any unauthenticated caller can pass subscriptionID via GET/POST and the handler sets ready_to_invoice_timestamp and ready_to_invoice=1 on that post, advancing billing workflow without a verified payment.

  subscriptions.php:81-82,396-416

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.