Mars Dynamic Mailer WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.2

Findings

4

Worst severity

high

Content hash

60e9e3b636f3c677a8c183c9… Copy

Findings

• high mc_mailer_send AJAX missing capability and nonce

  missing_capability

  wp_ajax_mc_mailer_send lets any logged-in user send arbitrary HTML email via wp_mail. check_ajax_referer is commented out with TODO; no current_user_can despite admin menu requiring manage_options. Enables spam relay and header injection (From/BCC) for low-priv accounts.

  includes/sender.php:4-76

• high Mail history AJAX discloses recipient PII without capability check

  information_disclosure

  wp_ajax_mc_mailer_get_history returns last 100 emails (address, name, country, open status) to any authenticated user with no nonce or capability check.

  includes/history.php:4-28

• medium mc_mailer_send also missing CSRF nonce

  missing_nonce

  Same handler: nonce verification is commented out, so a logged-in victim can be CSRF'd into sending mail if they visit an attacker page while authenticated.

  includes/sender.php:7-8

• medium Delete mail log AJAX missing capability and nonce

  missing_capability

  wp_ajax_mc_mailer_delete_log deletes by id for any logged-in user without nonce or manage_options check.

  includes/history.php:31-40

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.