Raffaello Product Sync WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

4.5.5

Findings

1

Worst severity

high

Content hash

9739a5fe138289376c1b6c42… Copy

Findings

• high Missing capability check on product sync AJAX enables unauthorized multi-store sync

  missing_capability

  ajax_auto_sync and ajax_manual_sync only call check_ajax_referer( 'rps_sync_action' ) before invoking RPS_Product_Sync::sync with attacker-supplied product_id (and store list for manual). There is no current_user_can( 'manage_woocommerce' ) / manage_options. A low-privileged authenticated user who obtains the nonce (embedded in product admin screens) can force product data to remote shops using stored API credentials.

  includes/class-plugin.php:110-135

  Recommendation

  Require current_user_can( 'manage_woocommerce' ) or manage_options immediately after the nonce check, matching the bulk-sync AJAX handlers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.