RoadMapWP Pro WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

2.4.3

Findings

1

Worst severity

high

Content hash

5c8fd68c07af357cd80f7763… Copy

Findings

• high Missing capability on delete taxonomy/terms AJAX

  missing_capability

  handle_delete_custom_taxonomy verifies wp_roadmap_delete_taxonomy_nonce then unsets entries from wp_roadmap_custom_taxonomies and update_option without current_user_can. handle_delete_selected_terms uses check_ajax_referer then wp_delete_term in a loop with no capability check. Any authenticated user can mint these nonces and destroy custom taxonomies or arbitrary terms in the requested taxonomy.

  app/ajax-handlers.php:279-337

  Recommendation

  Require current_user_can('manage_options') (matching admin menu caps) after nonce verification on both delete handlers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.