Critical findings.

Audited release

1.0

Findings

4

Worst severity

critical

Content hash

fcefa412a02a4316b44a45bb… Copy

Findings

• critical Unauthenticated booking creation with client-controlled price stored and paid

  unsafe_input

  wp_ajax_nopriv_create_booking accepts a public booking-nonce (rendered on the front-end form) and creates a published bookings CPT with attacker-supplied vbs_cost, contact fields, and notes. Cost is never recomputed server-side from car/distance before storage. Follow-on create_payment echoes that client cost into a PayPal _xclick amount field, enabling free/underpriced rides.

  include/form_handler.php:56-164

  Recommendation

  Recompute price server-side via calculateCost() and ignore client cost. Require rate limits, sanitize all fields, and bind PayPal amount to server-side cost only.

• critical Unauthenticated create_payment builds PayPal form from attacker-controlled amount (no nonce)

  missing_auth

  wp_ajax_nopriv_create_payment has no nonce or auth. It echoes POST cost/id/code into a PayPal HTML form amount/item fields. An unauthenticated attacker can mint payment forms for arbitrary amounts against the merchant PayPal email from settings.

  include/form_handler.php:167-200

  Recommendation

  Require booking ownership token/nonce, load amount exclusively from post meta after server-side pricing, and escape all echoed attributes.

• critical Stored XSS via unsanitized booking fields echoed in admin and email HTML

  xss_stored

  create_booking stores raw $_POST full_name, email, notes, pickup, dropoff into post meta. Admin list columns in vbs.php echo rwmb_meta values without escaping; get_email_template interpolates the same fields into HTML email. Unauthenticated bookers can inject script that executes when an admin views Bookings or opens the confirmation email HTML path.

  include/form_handler.php:75-136

  Recommendation

  Sanitize on write (sanitize_text_field/textarea) and escape on output (esc_html). Prefer wp_kses_post only where HTML is intentional.

• high PayPal form attribute injection via unescaped cost/code in create_payment response

  xss_reflected

  create_payment concatenates $cost and $code into HTML attribute values without esc_attr. Even aside from amount tampering, a crafted cost/code can break out of the attribute and inject markup into the AJAX HTML response rendered by the booking UI.

  include/form_handler.php:182-199

  Recommendation

  Escape with esc_attr() (and prefer JSON + client templating).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.