Jet Plugins Wizard WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

1.2.8

Findings

2

Worst severity

medium

Content hash

cff27afaad337cc2d73312ce… Copy

Findings

• medium Plugin installer AJAX action lacks capability and nonce checks

  missing_capability

  wp_ajax_jet_plugins_wizard_process_single_plugin dispatches to install_single_plugin()/activate_single_plugin() with no current_user_can() or nonce check (unlike the sibling install_plugin handler which requires install_plugins). Any authenticated user, including subscribers, can cause the site to download and install any plugin defined in the wizard configuration. The activation branch currently fatals because activate_plugin() is called with one argument, limiting impact to installation.

  includes/class-jet-plugins-wizard-installer.php:52, 252-300

  Recommendation

  Require current_user_can( install_plugins / activate_plugins ) and verify a nonce at the top of process_single_plugin().

• low Stored advanced-install plugin list writable by any logged-in user

  missing_capability

  wp_ajax_jet_plugins_wizard_store_plugins overwrites the jet_plugins_wizard_stored_plugins option with request data with no capability or nonce check; array_walk with esc_attr does not modify values. Lets subscribers alter the wizard's queued install list.

  includes/class-jet-plugins-wizard-data.php:60, 69-88

  Recommendation

  Add capability (install_plugins) and nonce checks; sanitize and validate slugs against the configured list.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.