Woocommerce Custom Order Number WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.1.5

Findings

1

Worst severity

high

Content hash

0098cc7c4694271595203a9d… Copy

Findings

• high Public REST regenerates custom order numbers without auth

  missing_permission_callback

  Four REST routes under CON/v1/utils (regenerate, reset, fill-gaps, persist-numbers) use permission_callback __return_true and WP_REST_Server::CREATABLE. Callbacks load all WooCommerce orders and rewrite custom order number meta with no authentication, capability, or nonce.

  inc/Subscriber/class-utils-subscriber.php:41-79

  Recommendation

  Use permission_callback that requires manage_woocommerce (or manage_options) and verify a REST nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.