Bonnier Purchase Plugin WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.6

Findings

2

Worst severity

high

Content hash

f2ece64cd096b26e552ca1ac… Copy

Findings

• high Open redirect on bonnier-purchase/callback via redirectUri

  unsafe_input

  Routes::callback reads redirectUri from the REST request and passes it to RedirectHelper::redirect, which emits Location: %s with a 302 and exit. There is no same-site/allowlist validation. Combined with missing permission_callback, unauthenticated attackers can craft trusted-looking WP JSON URLs that bounce victims to arbitrary external sites.

  src/Http/Routes.php:41-44

  Recommendation

  Validate redirectUri against an allowlist of payment/OAuth domains (or wp_validate_redirect to home_url); add an explicit permission_callback.

• medium REST routes registered without permission_callback

  missing_permission_callback

  register_rest_route for /callback and /purchase omits permission_callback, leaving the endpoints publicly callable. The purchase handler additionally trusts product_id, callback, and payment_attributes from the request when building payment URLs.

  src/Http/Routes.php:29-38

  Recommendation

  Add permission_callback appropriate to the flow (at minimum __return_true explicitly only after input validation) and sanitize/allowlist all redirect targets.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.