Compatibility Plugin for Woo Discount Rules WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.2

Findings

1

Worst severity

medium

Content hash

0c36c39389fc815848f1b7be… Copy

Findings

• medium CSRF: compatibility settings saved with no nonce

  csrf

  FWDRCIncludesAdmin::viewSettingPage() always calls saveConfig() then renders views/admin/settings.php. The form is method=post with hidden wdrc[save]=1 and checkbox names wdrc[<flag>]; there is no wp_nonce_field. saveConfig() trusts isset($_POST['wdrc']['save'])==1, walks every submitted key, sanitize_text_field()s values, json_encodes the map, and add_option/update_option('woo-discount-compatibility'). There is no check_admin_referer, wp_verify_nonce, or current_user_can inside the writer — the only gate is WordPress invoking the submenu callback after user_can_access_admin_page(). The menu is registered with capability edit_posts (too low for a WooCommerce pricing setting) but only when $submenu['woocommerce'] already exists, so on a default WC install the reachable victims are Shop Manager and Administrator, not Subscriber. An unauthenticated attacker who causes that victim to POST the form replaces the entire option (unchecked boxes are omitted, so a save-only POST clears all flags). Consumer FWDRCIncludesCompatibility::init() treats stored keys as booleans and registers filters that alter Discount Rules price math store-wide (currency division, has_price_override, skipping woocommerce_before_calculate_totals). Values are not echoed as HTML, so this is not stored XSS. First-party PHP has zero wp_verify_nonce calls.

  includes/admin.php:20-28,35-38,63-82

  Recommendation

  Add wp_nonce_field() to the settings form and check_admin_referer() at the start of saveConfig() before reading $_POST. Require current_user_can('manage_woocommerce') (or manage_options) in saveConfig itself, and pass that same capability to add_submenu_page instead of edit_posts. Allow-list the known flag keys rather than persisting every wdrc[] key.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.