High-severity findings.

Audited release

5.x

Findings

2

Worst severity

high

Content hash

d569535fe490294e47e5395c… Copy

Findings

• high Plugin locks all non-administrators out of wp-admin

  insecure_config

  On plugins_loaded the gateway registers restrict_admin_with_redirect on admin_init, which wp_safe_redirect()s any user lacking manage_options (and not doing AJAX) to the site front. Editors, Shop Managers, and Authors lose the entire admin UI whenever this payment plugin is active — unintended broken access / denial of service for legitimate staff.

  woocommerce-gateway-epayco-gateway.php:25-34

  Recommendation

  Remove restrict_admin_with_redirect entirely; WooCommerce already gates payment settings. If a redirect is needed, scope it to this plugin's screens only.

• medium Unprepared order_id interpolation in EpaycoOrder::ifExist

  sql_injection

  EpaycoOrder::ifExist concatenates $orderId into SQL without intval/prepare. Callers pass request-derived order_id from the unauthenticated confirmation path. Numeric-context injection (e.g. boolean/time-based) is not stopped by wp_magic_quotes.

  lib/EpaycoOrder.php:55-69

  Recommendation

  Use $wpdb->prepare('... WHERE order_id = %d', absint($orderId)) consistently (as ifStockDiscount already does with intval).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.