DPO Pay Add-On for Gravity Forms WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.2.0

Findings

2

Worst severity

high

Content hash

7184883037035cd96f2919e6… Copy

Findings

• high Declined DPO callback writes payment_status using attacker-controlled CompanyRef as entry ID

  missing_auth

  When verifyToken returns Result 901, notify_handler maps status to 2 and falls into notifyFailed(). That helper updates payment_status=Declined and adds an entry note using $notify_data['REFERENCE'], which is copied from GET CompanyRef (sanitize_text_field only). There is no check that CompanyRef equals the lead in gf_dpo_group_return, that the lead is a DPO payment, or that it is still Pending. Observable: complete a checkout that DPO declines (Result 901), keep that TransactionToken and the minted gf_dpo_group_return so the feed/company token still load, then replay with CompanyRef=<any sequential GF entry id>. GFAPI::update_entry_property marks that lead Declined, including already-Approved or non-DPO entries.

  class-gf-dpo-group.php:93-98,159-172,252-263

  Recommendation

  Update and annotate only the lead decrypted from gf_dpo_group_return (lead_id/eid). Treat CompanyRef as an integrity check against the stored companyRef, never as an entry id. Ignore leads that are not this add-on's and do not overwrite a terminal payment_status.

• medium Unauthenticated eid parameter loads any Gravity Forms entry into post content merge tags

  information_disclosure

  gw_dpo_group_post_content_merge_tags() is invoked with defaults (encrypt_eid=false, auto_append_eid=false) and hooks the_content on every front-end request. get_entry_id() takes GET eid; maybe_decrypt_entry_id() returns a numeric eid unchanged when encryption is off, then GFFormsModel::get_lead() loads that entry and GFCommon::replace_variables(..., $esc_html=false) substitutes merge tags in the post body. Entry IDs are sequential. If any public page or confirmation body contains {all_fields} or field merge tags (the add-on documents this pattern for confirmation pages), an unauthenticated visitor can enumerate ?eid=1,2,... and read other payers' PII. Encrypted eids from payment returns also decrypt here because the non-numeric branch always calls DPO_Group_GF_encryption().

  includes/dpo-group-tools.php:32-67,181-213,232-237

  Recommendation

  Default encrypt_eid to true (always require DPO_Group_GF_encryption of eid). Do not accept raw numeric IDs. Restrict merge-tag replacement to confirmation/success pages rather than every the_content call, and pass $esc_html=true into GFCommon::replace_variables.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.