High-severity findings.

Audited release

1.0.4

Findings

3

Worst severity

high

Content hash

2b9b00f654f7bc7f9327cd15… Copy

Findings

• high Shop Manager SQL injection via coupon usage report coupon_codes parameter

  sql_injection

  The Coupons by date report reads $_GET['coupon_codes'], runs wp_unslash (undoing wp_magic_quotes), then sanitize_text_field, and passes the values into WC_Admin_Report::get_order_report_data as an IN list. That helper concatenates the values into SQL as IN ('{$value}') with no $wpdb->prepare. A Shop Manager (view_woocommerce_reports, no manage_options) can visit admin.php?page=wc-reports&tab=orders&report=coupon_usage&coupon_codes=')+AND+SLEEP(5)--+- and execute arbitrary SQL. Time-based or UNION queries can extract wp_users password hashes. Shop Manager is explicitly blocked from editing administrator users via wc_modify_map_meta_cap, so this is privilege escalation. Same sink exists for other report where-clauses that pass unsanitized strings; product_ids reports correctly use absint. WooCommerce core patched this class of reports interpolation in 2025 (HackerOne 3198980); Classic Commerce 1.0.4 still has the 3.5-era code.

  includes/admin/reports/class-wc-admin-report.php:288-342

  Recommendation

  Pass coupon codes through $wpdb->prepare with a repeated %s placeholder list (or esc_sql each element after unslash). Do not interpolate unsanitized report filters into SQL. Restrict report filters to known coupon posts.

• high Shop Manager arbitrary local file download via downloadable product file paths

  file_access

  Product download files are stored as free-form paths. WC_Product_Download::is_allowed_filetype() returns true for any path with no extension, and file_exists() accepts absolute paths that start with /. WC_Download_Handler::parse_file_path() then maps those paths onto the local filesystem (ABSPATH-relative, /wp-content/..., or any scheme-less path that file_exists()) and force-downloads the file. A Shop Manager (edit_products, no manage_options) can set a downloadable product file to /etc/passwd or another extensionless server file, grant themselves a download (or buy a $0 product), and read it. PHP files such as wp-config.php are blocked on save by mime-type, but extensionless secrets and allowed-type files (txt/pdf/csv) anywhere on disk are not confined to uploads. WooCommerce 5.2+ restricted downloads to the uploads directory; this 3.5.3-based fork never received that check. The download endpoint itself is unauthenticated once a valid email/order_key/download_id tuple exists.

  includes/class-wc-download-handler.php:224-273

  Recommendation

  Resolve the path with realpath and require it to live under wp_upload_dir()['basedir'] (or an explicit allowlist). Reject absolute paths, .. segments, and extensionless files outside uploads. Re-validate the resolved path at download time, not only on product save.

• medium Shop Manager can fopen arbitrary server .csv/.txt files via product CSV importer

  file_access

  WC_Product_CSV_Importer_Controller takes $_REQUEST['file'] as a filesystem path. WC_Product_CSV_Importer::read_file() only checks wp_check_filetype against csv/txt and that the path does not contain '://'; it does not confine the path to the uploads directory. A Shop Manager with the import capability (assigned by default) who has a woocommerce-csv-importer nonce from the importer screen can set file to any readable .txt or .csv on the server (for example a credentials dump or backup named .txt). fopen reads it and the mapping UI echoes the first row as a sample. handle_upload() also accepts POST file_url as ABSPATH-relative csv/txt. Later WooCommerce versions chroot importer files to uploads.

  includes/admin/importers/class-wc-product-csv-importer-controller.php:151-153

  Recommendation

  Resolve the importer file with realpath and require it to be inside the uploads directory (or the attachment created by wp_handle_upload). Do not accept arbitrary file or file_url query arguments.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.