High-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

high

Content hash

18579f50a2270bfaf5c44f6f… Copy

Findings

• high API token and IPN HMAC secret written to world-readable uploads logs

  information_disclosure

  log() mkdir's wp_upload_dir()['basedir']/erip_expresspay at 0777 and appends express-pay-YYYY.MM.DD.log with no .htaccess or index. compute_signature logs 'RESULT - ' + token concatenated with invoice fields on every receipt_page invoice. On a failed signature check, check_ipn_response passes $this->secret_key_notify as the fourth argument to notify_fail, which interpolates it into the log line as 'secret key - '. WordPress serves uploads as static files, and the filename is the current date with dots, so an unauthenticated GET of /wp-content/uploads/erip_expresspay/express-pay-YYYY.MM.DD.log returns the Express Payments API token and the notification HMAC secret. Combined with finding 1, that secret lets an attacker forge a signed CmdType 1 even when the merchant enabled is_use_signature_notify. Logs also retain IPN bodies, order ids, and User-Agent. Triggering the leak does not require a prior order: any POST to the public wc-api notify URL with a bad Signature writes notify_fail, and check_ipn_response itself log_info's on every hit so the directory is created.

  includes/class-wc-gateway-expresspay-erip.php:574-670

  Recommendation

  Stop logging tokens, HMAC secrets, raw IPN bodies, and signature material. Write logs under a non-web directory (or wp-content/uploads with an Apache/nginx deny for that folder), create the directory as 0750 not 0777, and drop an index.php plus .htaccess deny. Rotate/delete existing express-pay-*.log files and rotate the leaked API token and notification secret in the Express Payments panel.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.