Greenheart Connects WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.5.2

Findings

2

Worst severity

high

Content hash

41b4bd984d932984f74906da… Copy

Findings

• high Unauth updateUserName / updateConsent IDOR on any userid

  nopriv handlers update display_name/user_nicename and ghc_consent_* user meta for arbitrary userid without auth or nonce.

  theme/setup.php:319-377

• medium Unauth ghc_BTTTTR_deleteUser triggers cancellation emails for any userid

  missing_auth

  nopriv handler reads userdata for posted userid and emails finance/admin to cancel billing. No auth; enables harassment/DoS of billing ops and PII disclosure of display_name+email in the mail body.

  theme/setup.php:289-318

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.