RaiPay for WooCommerce WP Registry grade D-. Critical findings · 1 findingWP RegistryCritical findings · 1 findingOpen the reportD-

Critical findings.

Audited release

0.1.3

Findings

1

Worst severity

critical

Content hash

f8cd305fc040a9c9814779e2… Copy

Findings

• critical Unauthenticated RaiPay webhook completes arbitrary WooCommerce orders when payment token meta is empty

  missing_auth

  Listener::setup() hooks webhook_listener on init whenever Plugin::is_valid_for_use() is true (store currency in USD/EUR/GBP and ~30 others). That does not require the RaiPay gateway to be enabled. webhook_listener fires on any request with $_GET['raipayListener']==='raipayWebhook' (no capability, nonce, HMAC, or login), then handle_webhook json_decodes php://input. If paid_at is non-null it takes intval(str_replace('order-','',$data->tag)) as the order id, loads get_post_meta($order_id,'raipay_woocommerce_payment_token',true), and on strict equality with $data->token calls $order->payment_complete($data->token). WordPress returns '' for missing single meta, so a JSON body {"paid_at":"1","tag":"order-123","token":""} matches every WooCommerce order that never went through RaiPay (and, on HPOS without post-meta sync, likely RaiPay orders too, because process_payment writes the token only via update_post_meta). There is no check that the order payment method is raipay, no amount/currency comparison, and no server-side GET back to api.raipay.io. Order IDs are sequential. Observable result is unpaid orders of any gateway moving to processing/completed with stock, emails, and downloads. Even for orders that do have a token, that value is the public checkout path https://raipay.io/checkout/{token} returned from process_payment, so the same webhook is also a self-service pay-bypass for the placing customer. Upstream last pushed 2018-01-17; RaiBlocks/RaiPay is defunct, so this handler will not grow a real signature.

  src/WooCommerce/Listener.php:13-56

  Recommendation

  Do not register the webhook unless the RaiPay gateway is enabled. Reject empty/missing tokens. Verify a RaiPay HMAC (or re-fetch the payment from api.raipay.io with the merchant credential) and require paid amount/currency/tag to match the WooCommerce order before payment_complete. Read/write the token via WC_Order meta APIs. Given the project has had no commits since 2018-01-17 and RaiPay is gone, deactivate and remove the plugin.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.