FuratPay for WooCommerce WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.0

Findings

2

Worst severity

high

Content hash

6b4f42b294e3717fab92bc1f… Copy

Findings

• high Unauthenticated payment status IDOR leaks order-received URL

  information_disclosure

  furatpay_check_payment_status / FuratPay_Gateway::check_payment_status are hooked to wp_ajax_nopriv_*. Guest checkout localizes furatpay-nonce. The handler takes any order_id, loads the order, and on paid status returns redirect_url from get_checkout_order_received_url()/get_return_url (contains order key). No check that the caller owns the order. Also invokes $order->payment_complete() based on remote API status for arbitrary order IDs.

  includes/class-furatpay-gateway.php:498-536

  Recommendation

  Bind polling to the current customer session/order key; never return order-received URLs for unrelated orders; do not call payment_complete from an unauthenticated oracle.

• medium IPN REST route uses weak permission_callback

  missing_permission_callback

  furatpay/v1/ipn registers permission_callback that only checks HTTP method === POST. Signature verification exists inside handle_ipn, but the route is intentionally world-open — acceptable if HMAC is solid; noted as defense-in-depth for missing_permission_callback style.

  includes/class-furatpay-ipn-handler.php:21-27

  Recommendation

  Keep signature verification mandatory; optionally add timestamp/body size limits and constant-time compare.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.