ePayco Subscriptions for WooCommerce WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

6.5.1

Findings

4

Worst severity

high

Content hash

48958c23eab7e64560ee116e… Copy

Findings

• high ePayco wc-api webhook continues after failed nonce (wp_die commented out)

  missing_auth

  The WooCommerce API callback webhook() for WC_WooEpaycoSuscription_Gateway verifies a WordPress nonce but the wp_die on failure is commented out, so processing continues for unauthenticated callers. The handler then reads order_id/epaycoToken from $_REQUEST and drives subscription/customer creation and order status updates without verifying an ePayco payment signature on this path. Observable consequence: unauthenticated hits to ?wc-api=WC_WooEpaycoSuscription_Gateway can reach payment/subscription state-changing logic (createOrUpdateEpaycoCustomer, validatePlan, order/subscription updates) whenever a usable token/order context is supplied.

  suscripciones_woocommerce-master/src/Gateways/EpaycoSuscription.php:648-657

  Recommendation

  Fail closed on auth: restore wp_die/wp_send_json_error when the nonce is missing/invalid for browser-originated POSTs, and for server IPN/confirmation use ePayco x_signature (authSignature) verification instead of a WP nonce. Never update order/subscription status without a verified signature or server-side charge confirmation.

• high ePayco wc-api webhook continues after failed nonce (wp_die commented out)

  missing_auth

  The WooCommerce API callback webhook() for WC_WooEpaycoSuscription_Gateway verifies a WordPress nonce but the wp_die on failure is commented out, so processing continues for unauthenticated callers. The handler then reads order_id/epaycoToken from $_REQUEST and drives subscription/customer creation and payment flow without verifying an ePayco payment signature on this path. Observable consequence: unauthenticated hits to ?wc-api=WC_WooEpaycoSuscription_Gateway can reach payment/subscription state-changing logic (createOrUpdateEpaycoCustomer, validatePlan, order redirects) whenever a usable token/order context is supplied.

  suscripciones_woocommerce-master/src/Gateways/EpaycoSuscription.php:648-657

  Recommendation

  Fail closed: restore wp_die/wp_send_json_error when the nonce is missing/invalid for browser-originated POSTs, and for server IPN/confirmation use ePayco x_signature (authSignature) verification instead of a WP nonce. Never update order/subscription status without a verified signature or server-side charge confirmation.

• medium Unauthenticated ePayco credential validation endpoint proxies attacker-supplied keys

  unnecessary_attack_surface

  validate_ePayco_request is registered as a public woocommerce_api endpoint and, with no capability or signature check, forwards $_REQUEST into ePayco_credentials_validation, which Base64-auths to apify.epayco.co using attacker-supplied epayco_publickey/epayco_privatey and returns the validation response. Observable consequence: unauthenticated callers can use the site as an open credential-validation oracle against ePayco and receive API validation bodies.

  suscripciones_woocommerce-master/src/Gateways/EpaycoSuscription.php:779-788

  Recommendation

  Restrict credential validation to manage_woocommerce (or manage_options) admin-ajax with a nonce, or remove the public wc-api validation route. Never accept private keys from unauthenticated request input.

• medium Unauthenticated ePayco credential validation endpoint proxies attacker-supplied keys

  unnecessary_attack_surface

  validate_ePayco_request is registered as a public woocommerce_api endpoint and, with no capability or signature check, forwards $_REQUEST into ePayco_credentials_validation, which Base64-auths to apify.epayco.co using attacker-supplied epayco_publickey/epayco_privatey and returns the validation response. Observable consequence: unauthenticated callers can use the site as an open credential-validation oracle against ePayco and receive API validation bodies.

  suscripciones_woocommerce-master/src/Gateways/EpaycoSuscription.php:779-788

  Recommendation

  Restrict credential validation to manage_woocommerce (or manage_options) admin-ajax with a nonce, or remove the public wc-api validation route. Never accept private keys from unauthenticated request input.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.