Bricks Form Data Manager WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

2.9.0

Findings

1

Worst severity

high

Content hash

e6e6cebb73ea81f908fbfe84… Copy

Findings

• high Form submission XLS files publicly readable under uploads

  information_disclosure

  protect_directory() writes an .htaccess that Deny-from-all then explicitly Allows *.xls/*.xml/*.csv. Combined with data_dir under wp-content/uploads/form-data, submitted form PII (emails, consent fields) is world-readable without auth when Apache .htaccess is honored. Subscriber and unauthenticated visitors can download submissions.xls / motodiktio.xls if they know or guess the path.

  bricks-form-excel-handler.php:81-91

  Recommendation

  Deny all web access to the form-data directory (including .xls). Serve downloads only through the authenticated admin_init handler. Prefer storing outside the web root or using randomized non-guessable filenames.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.