High-severity findings.

Audited release

1.2.3

Findings

2

Worst severity

high

Content hash

d91cf2a4185336c63549996c… Copy

Findings

• high Missing capability check on option-value AJAX reader

  missing_capability

  wp_ajax_spyoption verifies spyoption-ajax-nonce then returns get_option(sanitize_key(opt)) as JSON with no current_user_can. Any authenticated user can create that nonce for their session and read arbitrary options (e.g. API keys, SMTP passwords, license keys).

  spy-options.php:64-81

  Recommendation

  Require current_user_can('manage_options') before reading options; avoid returning sensitive option values to the browser.

• medium Development cleanup tool intended for non-production use

  dev_tool_in_production

  Help text states the plugin is not intended to run in production and can bulk-delete options. Leaving it active expands attack surface (option enumeration UI + AJAX reader).

  spy-options.php:156-162

  Recommendation

  Do not deploy on production sites; deactivate after cleanup.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.