BB Cart WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

3.8.26

Findings

2

Worst severity

medium

Content hash

c55fc1bb43cea26e618e1383… Copy

Findings

• medium Unauthenticated BB Cart CSV import processor

  bb_cart_import_do_import is hooked to wp_ajax_nopriv_ and ajax_do_import performs no capability or nonce check before importing rows into transaction batches from a pending upload.

  admin/import.php:28-29,335-380

• medium PayDock webhook accepts events without signature verification

  paydock-webhook.php bootstraps WordPress and processes JSON events (transaction_success, subscription_*, etc.) after only inferring gateway mode via API lookup. No HMAC/shared-secret validation — forged events can mutate donation/transaction state.

  paydock-webhook.php:1-80

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.