MuviNime WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.1.4

Findings

2

Worst severity

high

Content hash

d3b57ea76ef49a0a43eaf6bc… Copy

Findings

• high Unauthenticated access to draft posts list and application logs

  information_disclosure

  GET muvinime/v1/posts returns drafts and player meta; GET log/clear-log read or wipe app.log. No permission_callback. Information disclosure and log tampering for unauthenticated users.

  src/Rest/PostController.php:117-175

  Recommendation

  Gate posts/log/clear-log behind manage_options or API key; never expose drafts publicly.

• medium Hardcoded third-party player API key in source

  hardcoded_credentials

  PostController embeds a fixed player API key in an outbound request URL (key=kDcZqfeIoD), which can be extracted from the plugin and abused against the remote player API.

  src/Rest/PostController.php:236-239

  Recommendation

  Store the player API key in options or environment configuration; do not hardcode secrets.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.