High-severity findings.

Audited release

3.3.2

Findings

2

Worst severity

high

Content hash

50c7ed2c724979bf2c569790… Copy

Findings

• high Privileged AJAX (credentials, tax, AWB create/delete) registered nopriv with nonce-only auth

  missing_auth

  Ajax::init and WooOrder::init hook the same callbacks on both wp_ajax_ and wp_ajax_nopriv_ for saveConnection, updateConnection, saveSettings, saveAdvanceSettings, savePaymentSettings, saveTaxRates, saveTaxRatesOffices, createShipment, saveShipment, deleteShipment, requestCourier, address/office/shipping-method writes, and related UI loaders. None of those callbacks call current_user_can(). The only gate is check_ajax_referer for a per-action nonce. Those nonces are printed in includes/view/settings.php (manage_options page) and on shop_order admin UI / the HTML returned by createShipment — a default Subscriber or logged-out visitor is not shown them, so check_ajax_referer currently stops a customer who cannot scrape admin HTML. Because the actions are nopriv and capability-free, any valid nonce for that action (stolen admin nonce, future public localization, uid-0 nonce if settings.php is ever rendered logged-out) is sufficient to: overwrite dpdro_settings username/password (saveConnection also TRUNCATEs services/clients/addresses and file_put_contents PHP under includes/woo/services/{service_id}.php via createServicesFile); rewrite payment_tax/payment_zones used as COD fees on checkout; create or delete real DPD shipments (saveShipment/deleteShipment talk to api.dpd.ro with the store credentials); request a courier pickup. getOffices and shipmentInfo are wp_ajax_ only but likewise lack a capability check.

  includes/ajax.php:51-67

  Recommendation

  Drop every wp_ajax_nopriv_ registration for admin/AWB actions. In each callback, require current_user_can('manage_options') for settings/connection/tax and current_user_can('edit_shop_orders') for shipment/courier/address/office. Keep the nonces. Do not generate shipping-method PHP files from API-supplied service names; use a static map.

• medium TLS certificate verification disabled on all DPD API calls

  insecure_config

  LibraryApi::request() sets CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to false for every call to https://api.dpd.ro/v1/, including authentication, calculate (checkout rates), shipment create/delete, pickup, and print. The POST body always contains the store userName and password. A network attacker in a position to intercept those connections can steal DPD credentials, alter quoted rates, or tamper with AWB payloads. Combined with the web-accessible logs.json and unserialize() of on-disk API cache, a MITM can also plant cache contents.

  library/api.php:54-70

  Recommendation

  Leave cURL’s default certificate verification enabled (VERIFYPEER true, VERIFYHOST 2). Do not add an option to disable it in production.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.