WooCommerce Billplz WP Registry grade F. Critical findings · 2 findingsWP RegistryCritical findings · 2 findingsOpen the reportF

Critical findings.

Audited release

1.4.0

Findings

2

Worst severity

critical

Content hash

562df2b0920da3b6f0014408… Copy

Findings

• critical Receipt handler completes any pending order using a swapped paid Billplz bill ID

  auth_bypass

  woocommerce_receipt_billplz runs EXN_WC_Billplz::receipt_page on the WooCommerce order-pay/receipt screen (checkout/order-pay/{id}/?key=…, including Billplz's redirect_url from get_checkout_payment_url(true) and the my-account 'Change Payment' URL installed by replace_pay_button). The order object comes from WooCommerce; the bill id is taken solely from $_GET['billplz']['id'] and is never compared to the order's _transaction_id (stored at process_payment), to $billplz->amount vs order total, or to reference_1 (the order id sent when the bill was created). If the order is still pending, the plugin wp_safe_remote_get's https://www.billplz.com/api/v3/bills/{attacker_id} with the merchant API secret and update_order_status() calls $order->payment_complete($billplz->id) whenever that bill's paid flag is true. A guest or customer pays a cheap order, copies that paid bill id (return URL, _transaction_id, Billplz URL), then opens their expensive pending order's pay URL with billplz[id] set to the cheap paid bill and receives goods/stock/processing-email as if the expensive order were paid. The wc-api callback does bind POST id via find_order_id(_transaction_id) and is not this substitution; it also does not verify Billplz X-Signature, but it re-fetches the bill so it cannot fake paid. Same receipt_page bug remains on GitHub master (v1.4.2, last commit 2016-12-05).

  class/class-exn-wc-billplz.php:307-326,364-393

  Recommendation

  Ignore attacker-supplied bill ids for confirmation. Load the bill id from the order's _transaction_id (or require GET id to hash_equals it). Refuse payment_complete unless Billplz amount (cents) matches the order total and reference_1 matches the order id. Verify Billplz X-Signature on redirect and callback. Prefer the official Billplz-for-WooCommerce plugin.

• medium Order-meta migration AJAX has no capability or nonce check

  missing_capability

  exn_wc_billplz_data_check on plugins_loaded registers wp_ajax_exn_wc_billplz_migrate whenever any postmeta row has meta_key=_billplz_id (pre-1.2.0 leftover). exn_wc_billplz_run_migration has no current_user_can, no check_ajax_referer, and no order ownership check. Any logged-in role including subscriber/customer can POST admin-ajax.php action=exn_wc_billplz_migrate and the handler copies that row's meta_value onto _transaction_id then delete_post_meta _billplz_id and _billplz_url. That overwrites the live WooCommerce transaction id used by callback_url/find_order_id and by get_transaction_url on my-account. The in_admin_footer script sends the same action with no nonce, so a logged-in admin can also be CSRF'd into migrating. Handler is not registered on a fresh 1.4.0 install that never had _billplz_id; it is live on stores that upgraded from 1.0/1.1 and never clicked the notice.

  exn-wc-billplz.php:143-188

  Recommendation

  Require current_user_can('manage_woocommerce') and check_ajax_referer in the same handler. Do not register the AJAX action on plugins_loaded for every front-end request; gate it in admin and stop after migration completes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.