BILLZ WP Sync WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.2.9

Findings

1

Worst severity

high

Content hash

c36a6016f4fb9660d7efff68… Copy

Findings

• high wp_ajax_billz_wp_sync_create_transaction has no capability or nonce check

  missing_auth

  create_transaction_ajax is registered only on wp_ajax_ (any logged-in user). It reads order_id from $_POST, loads the WooCommerce order, and calls BILLZ API orders.create / orders.apply using the site JWT from filter billz_wp_sync_jwt_token, then updates order meta. There is no check_ajax_referer and no current_user_can. A Customer/Subscriber who learns an order ID can push fulfillment transactions to BILLZ for arbitrary orders. Sibling save handlers at lines 337/354 do check edit_post; this AJAX path does not. Observable: POST admin-ajax.php?action=billz_wp_sync_create_transaction&order_id=N as Customer.

  includes/class-billz-wp-sync-transactions.php:163-178

  Recommendation

  Require check_ajax_referer and current_user_can('edit_shop_orders') (or edit_post on the order) before any BILLZ API call.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.