Xophz Bazaar Warehouse WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

26.10.11

Findings

3

Worst severity

high

Content hash

15fe48609fbb72933f731792… Copy

Findings

• high Missing capability on saveProduct — any logged-in user can create/edit WooCommerce products

  missing_capability

  wp_ajax_save_product routes to saveProduct(), which reads JSON input and creates or updates a WC_Product (name, prices, SKU, stock, categories, status publish) and can write a base64 image into uploads. There is no current_user_can() or nonce check. Any authenticated user (including Subscriber) can therefore create or overwrite products.

  xophz-compass-bazaar/admin/class-xophz-compass-bazaar-admin.php:143-250

  Recommendation

  Require current_user_can('manage_woocommerce') or edit_products, and verify a nonce, before any product mutation.

• high Missing capability on updateProductStock — any logged-in user can change stock

  missing_capability

  wp_ajax_update_product_stock calls updateProductStock() which sets/adds/subtracts stock_quantity for an arbitrary product_id from JSON input with no capability or nonce check. Any logged-in user can manipulate inventory.

  xophz-compass-bazaar/admin/class-xophz-compass-bazaar-admin.php:483-520

  Recommendation

  Gate with manage_woocommerce (or edit_products) and a valid AJAX nonce.

• medium getBankDetails exposes WooCommerce BACS / stored bank account numbers to any logged-in user

  information_disclosure

  wp_ajax_bazaar_get_bank_details returns bank_name, routing/sort_code, account_number, and IBAN from woocommerce_bacs_accounts / bazaar_* options with no capability check. saveBankDetails correctly requires manage_woocommerce, but the read path does not. Any authenticated user can harvest merchant banking details.

  xophz-compass-bazaar/admin/class-xophz-compass-bazaar-admin-orders.php:1366-1386

  Recommendation

  Require the same capability as saveBankDetails (manage_woocommerce / edit_shop_orders) before returning account numbers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.