Trafficontent WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

medium

Content hash

2a8048cad8e130fe754c0057… Copy

Findings

• medium Site connect / consent form missing CSRF nonce

  csrf

  trafficontent_welcome_page processes POST trafficontent_agree without wp_verify_nonce/check_admin_referer, immediately update_option('trafficontent_consent_given', true), then schedules remote registration that stores trafficontent_token. An attacker can CSRF a logged-in administrator into connecting the site.

  admin/welcome.php:62-93

  Recommendation

  Add wp_nonce_field to the form and verify with check_admin_referer before any option updates or remote registration.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.