Medium-severity findings.

Audited release

1.3.1

Findings

1

Worst severity

medium

Content hash

40514c476e7bdee48d98346b… Copy

Findings

• medium Public REST route creates on-hold WooCommerce orders with no cart, nonce, or rate limit

  dos

  POST /wp-json/awof/v1/processing is registered with permission_callback __return_true. Rest::processing() always calls WC()->checkout()->create_order() with billing_email/first_name/phone from the request, then $order->update_status('on-hold'), $order->update_meta_data('_awof_quick_order', true), and WC()->cart->empty_cart(). It never checks WC()->cart->is_empty(), never calls wp_verify_nonce, never consults woocommerce_enable_guest_checkout / is_registration_required(), and never runs process_checkout() / woocommerce_checkout_process (the hook checkout captcha plugins use). Default REST args require only awof-phone (option woocommerce_awof_form_fields defaults to that key). WooCommerce's own checkout refuses an empty cart and requires the woocommerce-process_checkout nonce; this plugin bypasses both. Observable on a default install: curl -X POST /wp-json/awof/v1/processing -d awof-phone=79990000000 as uid 0 creates a wc-on-hold order with no line items, fires admin New Order email (pending_to_on-hold), and can be repeated to flood orders and mail. If a session cart has products, the same call reduces stock via woocommerce_order_status_on-hold → wc_maybe_reduce_stock_levels without payment. The form's wp_rest nonce is irrelevant for guests because WP REST only enforces it for cookie-authenticated users.

  classes/class-rest.php:32-84,93-107

  Recommendation

  Reject the request when WC()->cart is empty or the session has no cart hash. Verify a wp_rest (or dedicated cart) nonce inside the callback for guests as well as logged-in users, or switch permission_callback to a function that checks that nonce. Honor woocommerce_enable_guest_checkout / is_registration_required(). Rate-limit the route and/or fire woocommerce_checkout_process so captcha and checkout-validation plugins still run. Do not update_status('on-hold') until those checks pass.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.