Mini Whatsapp Floating WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

medium

Content hash

4bf6f8b17ee6c004681ed942… Copy

Findings

• medium Settings write missing capability check and nonce verification

  missing_capability

  fwab_add_number_action on admin_post_fwab_add_number updates option fwab_whatsapp_number from $_POST. The settings form outputs wp_nonce_field('fwab_add_number') but the handler never calls check_admin_referer/wp_verify_nonce, and never checks current_user_can('manage_options'). Any authenticated role (subscriber+) can change the site-wide WhatsApp number used in the frontend footer link (social-engineering / misdirection).

  mini-whatsapp-floating.php:50-57

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.