Awesome Enterprise WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.3.3

Findings

3

Worst severity

high

Content hash

c2c6bd3dc76685e0bfed7be2… Copy

Findings

• high Unauthenticated AJAX creates published device_tokens posts

  missing_auth

  wp_ajax_nopriv_aw2_save_device_tokens → save_device_token() inserts a publish post_type device_tokens from unsanitized $_REQUEST fields with no nonce or capability check. Unauthenticated visitors can flood the database and attach arbitrary device_token/user_id meta.

  libraries/notifications.php:4-118

  Recommendation

  Remove nopriv registration or require authenticated user + nonce; sanitize inputs; rate-limit.

• medium Unauthenticated aw2_cmb2_form AJAX discloses module metadata

  information_disclosure

  wp_ajax_nopriv_aw2_cmb2_form loads aw2_module posts by slug from $_REQUEST and renders CMB2 forms / install prompts without authentication.

  libraries/module-distribution/shortcode-generator.php:49-80

  Recommendation

  Drop nopriv hook; require edit capabilities and nonce.

• medium Authenticated CSV chunk parser AJAX lacks capability/nonce

  missing_capability

  wp_ajax_parse_chunk_collection_sheets processes uploads under uploads/sheets and fires do_action('row-'.$_POST['hook_type']) with no capability or nonce checks.

  libraries/mm-csv-importer.php:190-232

  Recommendation

  Restrict to administrators, verify nonce, whitelist hook_type values.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.