paymycheckout WP Registry grade F. Critical findings · 2 findingsWP RegistryCritical findings · 2 findingsOpen the reportF

Critical findings.

Audited release

1.0.1

Findings

2

Worst severity

critical

Content hash

2e849880c18582bd6c8549b4… Copy

Findings

• critical Unauthenticated payment webhook completes arbitrary orders

  auth_bypass

  Wc_paymycheckout_tigopesa_gateway registers woocommerce_api_paymentcomplete -> webhook(). The handler takes $_GET['id'], loads the order, calls payment_complete() and reduce_order_stock() with no authentication, HMAC, or payment-processor signature check. Any unauthenticated visitor can mark unpaid orders as paid by requesting /?wc-api=paymentcomplete&id=<order_id>, enabling payment fraud and inventory theft.

  libs/Wc_paymycheckout_tigopesa_gateway.php:62-69,275-285

  Recommendation

  Verify Tigo callback authenticity (shared secret, signed payload, or server-side payment status lookup) before payment_complete(); reject missing/invalid proofs; never trust client-supplied order id alone.

• medium Webhook reflects and stores raw $_GET including potential PII

  information_disclosure

  webhook() echoes json_encode($_GET) to the HTTP response and writes the full $_GET array into the webhook_debug option without sanitization. Unauthenticated callers can pollute site options and observe reflected query data.

  libs/Wc_paymycheckout_tigopesa_gateway.php:278-284

  Recommendation

  Remove debug echo/option writes from production callback; log sanitized fields server-side only after auth.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.