WhatArmy Watchtower WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

3.2.6

Findings

1

Worst severity

low

Content hash

ee049f8c8fde8ff5a85a5958… Copy

Findings

• low Weak access token generation (md5 of uniqid)

  Token::generate() returns md5(uniqid()) without CSPRNG. Tokens protect high-impact REST (backups, OTA admin login). Predictability risk is limited on modern PHP but falls short of wp_generate_password/random_bytes guidance.

  src/class-token.php:16-28

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.