AR Design GLS Shipping for WooCommerce WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.4.10

Findings

1

Worst severity

medium

Content hash

e68d859df84f56c92d7156ff… Copy

Findings

• medium GLS order AJAX handlers lack capability checks

  missing_capability

  wp_ajax_gls_generate_label, wp_ajax_gls_get_parcel_status, and wp_ajax_gls_update_pickup_location verify only the WooCommerce shared nonce action import-nonce. There is no current_user_can('edit_shop_orders') (unlike ajax_mark_label_printed in the workflow class). Any authenticated user who can obtain import-nonce — including roles that see Woo product import or HPOS admin screens but should not manage fulfillments — can generate billed GLS labels, poll parcel status, and overwrite _gls_pickup_info on arbitrary orders. Subscriber/Customer cannot mint that nonce from the storefront, so blast is authenticated low-privilege shop roles rather than unauth.

  includes/admin/class-gls-shipping-order.php:415-435

  Recommendation

  Add current_user_can('edit_shop_orders') (and a per-order edit_post/order cap) immediately after the nonce check in generate_label_and_tracking_number, get_parcel_status, and update_pickup_location. Prefer a plugin-specific nonce over Woo's shared import-nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.