Frame WooCommerce Gift Cards WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA- Bitbucket

Low-severity findings only.

Audited release

3.0.1

Findings

1

Worst severity

low

Content hash

c87ed165622b0c37c4e20b1a… Copy

Findings

• low Apply gift card AJAX missing nonce (CSRF)

  csrf

  wp_ajax and wp_ajax_nopriv woocommerce_apply_giftcard map to ajax_apply_gift_card which validates only that giftcard_code is present, then mutates WC()->session. No check_ajax_referer/wp_verify_nonce. Cross-site POSTs can apply a gift card code into a victim cart session (balance depletion / checkout manipulation when codes are known or guessed).

  includes/class-checkout-hooks.php:20-74

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.