Fachbetrieb finden WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

2.1.1

Findings

2

Worst severity

medium

Content hash

80e2c91f1fbe1716dfeeb8ff… Copy

Findings

• medium CSRF: admin_post_fachbetrieb lacks nonce verification

  csrf

  State-changing handler checks current_user_can('publish_posts') but never check_admin_referer/wp_verify_nonce. An Author/Editor visiting an attacker page can be forced to create, update, or delete companies and categories.

  includes/admin.php:14-79

  Recommendation

  Add check_admin_referer on every inner_action and emit matching wp_nonce_field in admin forms. Consider raising capability to manage_options.

• low Public REST geocode endpoint without permission_callback

  unnecessary_attack_surface

  register_rest_route for /coordinates omits permission_callback (public) and forwards attacker-controlled address strings to OpenStreetMap Nominatim via the server. Rate-limited to 1 rps but still an unauthenticated outbound proxy.

  includes/rest.php:26-66

  Recommendation

  Add an explicit permission_callback, require a nonce or logged-in user, and cap/cache aggressively.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.