Senha Única USP WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

2.0.3

Findings

2

Worst severity

medium

Content hash

85734fb0ca9e5441091a0883… Copy

Findings

• medium REST routes use empty permission_callback

  missing_permission_callback

  register_rest_route for login/logout sets permission_callback to empty string. OAuth callbacks must be public, but empty string is non-callable and relies on ambiguous REST core handling; use __return_true explicitly and document public access.

  senhaunica-wordpress.php:25-39

  Recommendation

  Set permission_callback to '__return_true' for the OAuth callback routes.

• medium SSO always assigns administrator role

  insecure_config

  loginUser() calls $obj_user->add_role('administrator') for every allowlisted Senha Única user. Misconfigured $senhaunicaAdmins / SENHAUNICA_ADMINS yields full admin privilege. Prefer mapping to a least-privilege role or explicit role config.

  senhaunica-wordpress.php:157-159

  Recommendation

  Make target role configurable and default to a non-administrator role; never hardcode administrator.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.