Hanmoto Helper WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.7.8

Findings

2

Worst severity

high

Content hash

d7c333effbfc3c7f77372326… Copy

Findings

• high edit_posts users can create inventory rows for any product and apply them to WooCommerce stock

  missing_capability

  When hanmoto_use_order_manager is enabled, ModelEvent registers REST routes under hanmoto/v1/inventories/{post_id} whose permission_callback is only current_user_can('edit_posts'). POST creates a published inventory CPT row (wp_insert_post does not check publish_posts or edit_product) with attacker-controlled product ID as post_parent, copies supplier/transaction terms from the event, and stores unit price/amount/margin. The sibling POST hanmoto/v1/inventory/{inventory_id} then checks current_user_can('edit_post', $inventory_id) — true for an Author on the row they just published — and calls wc_update_product_stock() on that product or a chosen variation, writing _applied_at. Authors and Contributors lack edit_products/manage_woocommerce, so this is a privilege jump into catalog stock. PUT on the same inventories route updates _group on arbitrary inventory IDs with no per-post edit_post check (IDOR). Subscriber/customer cannot call these routes. Observable: Author sets any in-stock product to 0 (or inflates stock) via two REST calls; storefront add-to-cart and stock emails follow WooCommerce _stock.

  src/Hametuha/HanmotoHelper/Models/ModelInventory.php:400-516

  Recommendation

  Require manage_woocommerce or current_user_can('edit_product', $product_id) on inventory create, stock-apply, bulk-realize, and group-assign routes. On PUT, also require edit_post (or edit_others_posts) for each inventory ID. Do not wp_insert_post with post_status=publish for roles that cannot publish or edit the parent product.

• high Stored XSS in the inventory list table via unescaped inventory-event title

  xss_stored

  BookSelector::admin_columns renders the inventory_group column with printf('<a href="%s">%s</a>', get_edit_post_link($group), get_the_title($group)) and no esc_html/esc_url. Inventory-event supports titles and uses capability_type post, so a Contributor/Author can create an event whose title is HTML (WordPress does not kses post_title). POST hanmoto/v1/inventories/{event_id} (edit_posts) then publishes an inventory row with _group set to that event, which appears on edit.php?post_type=inventory for Editors and Administrators. A title such as <img src=x onerror=…> or <script>…</script> executes in the wp-admin origin. Sibling columns escape titles; this one does not. The same unescaped title is not used on the public storefront (inventory CPT is public=false).

  src/Hametuha/HanmotoHelper/Utility/BookSelector.php:197-203

  Recommendation

  Escape the URL with esc_url() and the title with esc_html() (the item_title column already does). Treat get_the_title() as untrusted HTML everywhere it is printed.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.