Neura WooCommerce Sync WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

Low-severity findings only.

Audited release

1.16.6

Findings

1

Worst severity

low

Content hash

6950f64a4e8bb9367080bd4c… Copy

Findings

• low Missing capability check on sync/test AJAX handlers

  missing_capability

  ajax_sync_all_products, ajax_sync_all_orders, ajax_test_push, ajax_get_sync_stats and ajax_test_connection call check_ajax_referer('nwws_nonce') but (unlike ajax_disconnect/ajax at 1795/1848) do NOT call current_user_can. These trigger mass pushes of the whole product catalog and all orders (incl. customer PII) to the configured Neuramerce endpoint, probe a configured URL, or return store stats. Practical exploitation is gated because the 'nwws_nonce' is only minted and localized on the manage_woocommerce/manage_options settings page, so a logged-in low-priv user cannot obtain a valid nonce; hence low (defense-in-depth), not a live BAC.

  neura-wp-woo-sync.php:1927-1972,2004-2033

  Recommendation

  Add current_user_can('manage_woocommerce') (as the other handlers do) to every state-changing nwws_* AJAX handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.