High-severity findings.

Audited release

1.1.0

Findings

2

Worst severity

high

Content hash

f334164a25da40854051734e… Copy

Findings

• high Unauthenticated REST /amego/v1/test issues e-invoices with stored Amego credentials

  missing_permission_callback

  src/test.php is required from the main plugin file in production. amego_test_endpoint() registers POST /wp-json/amego/v1/test with permission_callback __return_true and no nonce. amego_test_handler() ignores the request body and always calls test_send_invoice(), which reads options amego_invoice and amego_app_key, builds a hardcoded C0401 payload (OrderId=unix time, BuyerName 'Amego woocommerce', three 'Product' lines, SalesAmount/TotalAmount 180), signs with md5(json + time + app_key), and curl-POSTs to https://invoice-api.amego.tw/json/c0401. The README documents this as an unauthenticated curl with no token. Anyone on the internet can therefore mint Taiwan e-invoices against the merchant's 統編 and App Key, exhaust the government-allocated invoice range, and create tax records that do not match WooCommerce orders. The REST response is only {success:true}; the Amego body is written to the public plugin log (see sibling finding). This is a leftover test/dev tool, not a webhook that validates an Amego signature.

  src/test.php:7-29

  Recommendation

  Remove src/test.php from the production plugin (do not require it from woocommerce-amego.php). If a health-check must remain, gate it with permission_callback current_user_can('manage_options') plus a REST nonce, and never call the live C0401 issue API from an unauthenticated route.

• high Invoice PII and PHP errors written to web-accessible plugin logs/

  information_disclosure

  src/log.php sets $log_path to plugin_dir_path(__FILE__).'../logs' (wp-content/plugins/woocommerce-amego/logs) and print_log() file_put_contents appends to amego.log with no flock/htaccess/capability check. The shipped zip already contains empty logs/amego.log and logs/error.log and no .htaccess or index.php, so the path is predictable and typically served as a static file. send_invoice() (woocommerce_payment_complete) logs the full C0401 JSON — BuyerName, BuyerAddress, BuyerPhoneNumber, BuyerEmailAddress, CarrierId1/2, NPOBAN, BuyerIdentifier (company tax ID), product names/amounts — then logs the Amego API response (invoice numbers / errors). test_send_invoice() logs the same for the unauth REST probe. The same file also ini_set('log_errors',1), ini_set('error_log', "$log_path/error.log"), and set_error_handler('error_handler') on every WordPress request, so PHP errors from this plugin and the rest of the site are redirected into the same public directory. After any completed payment (or a single POST to /wp-json/amego/v1/test), an unauthenticated GET of /wp-content/plugins/woocommerce-amego/logs/amego.log discloses other customers' invoice PII.

  src/log.php:3-22

  Recommendation

  Stop logging PII. If logging is required, write under wp-content/uploads with a random unguessable name, deny HTTP access (.htaccess + web-server rule), and never ship world-readable log files in the plugin zip. Do not call set_error_handler or ini_set('error_log') from a plugin on every request. Delete existing amego.log/error.log from deployed copies.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.