S Kanban WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.3

Findings

1

Worst severity

high

Content hash

ff71a4ccc58e348462133559… Copy

Findings

• high Multiple Kanban AJAX handlers lack capability checks

  stk_add_column, stk_add_card, stk_move_column, stk_move_card, and stk_status_priority verify only s-tier-kanban-nonce (localized on wp_enqueue_scripts for frontend). They do not call is_user_kanban_admin()/is_user_kanban_creation(). Any authenticated user who loads a page with the Kanban script can create columns/cards, reorder boards, and change status/priority on arbitrary cards. Sibling delete/title handlers correctly gate; these do not.

  s-tier-kanban.php:116-200,336-400

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.