High-severity findings.

Audited release

1.1.3

Findings

1

Worst severity

high

Content hash

b79aa29a8843d24e1d5d8904… Copy

Findings

• high Client-controlled awooc_options JSON sets WooCommerce order totals and item meta on one-click submit

  unsafe_input

  The plugin's only state-changing path is Handler::add_option_in_order on awooc_create_order, fired by required parent Art WooCommerce Order One Click after CF7 successfully posts the one-click form (wpcf7_before_send_mail) when woocommerce_awooc_created_order is enabled. extract_options json_decodes posted_data['awooc_options'] with no signature, no product-option ID lookup, and no server-side price recompute. That hidden input is added via awooc_added_hidden_fields and filled by inline JS from event.detail.data.toOrder.options, so a guest can replace it with arbitrary JSON before submit. YithWoocommerceProductAddOns, SimpleProductOptions, ArtWoocommerceProductOptions, and AdvancedProductFields process_options then do $options_total += $option['price'] (APF: $price['value'] on an array), $item->set_total(($options_total + $product->get_price()) * qty), and $order->set_total(). PHP empty(-999) is false, so a large negative price collapses the pending-payment order total that WooCommerce invoices, order-pay, reports, and gateways consume. The same JSON's label/value are written with $item->update_meta_data onto every line item (ExtraProductOptions is meta-only). added_options() already knows how to resolve posted option IDs against each vendor plugin's stored prices during the popup AJAX; that logic is not reused at order time.

  src/Handler.php:31-58,64-78

  Recommendation

  Treat awooc_options as a list of selected option identifiers/raw values only. On awooc_create_order, re-run the same server-side resolution already used in added_options() (look up each ID in the active option plugin, take stored label and price, ignore client price). Do not call set_total/set_subtotal from request JSON. Sanitize meta keys/values (sanitize_text_field) before update_meta_data. Optionally HMAC the AJAX toOrder payload and verify it at order time.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.