Sunflower Map Points WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.7.0

Findings

1

Worst severity

high

Content hash

1411141e47bb42d2abeee6b2… Copy

Findings

• high Unauth map form publishes POIs and trusts client-supplied mailTo

  unsafe_input

  sunflower_map_points_handle_leaflet_form (nopriv) verifies a public feedback nonce then: (1) base64-decodes reversed $_POST['mailTo'] into $to for wp_mail, enabling unauthenticated mail to arbitrary addresses when the form nonce is present on the page; (2) wp_insert_post custompoi with post_status publish so attacker content appears on the public map without moderation.

  sunflower-map-points.php:88-163

  Recommendation

  Ignore client mailTo; always mail get_option(admin_email) or a settings recipient. Insert POIs as pending/draft pending moderation.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.