小半WP图床 WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.3

Findings

1

Worst severity

low

Content hash

380bd5637245cf480784cd6e… Copy

Findings

• low Guest image uploads to the media library enabled by default

  unnecessary_attack_surface

  handle_image_upload is registered for wp_ajax_nopriv and guests are allowed unless the admin enables simple_image_hosting_disable_guests. Uploads go through wp_handle_upload (WP mime/extension checks) with an admin-configured extension allowlist and size limit and a front-end nonce, so this is storage-abuse surface rather than code execution. Notably logged-in users are refused unless their role is allowlisted, while anonymous users are not.

  simple-image-hosting.php:358-468

  Recommendation

  Default guest uploads to off, add per-IP rate limiting, and treat guests at least as strictly as logged-in roles.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.