WooCommerce IceNox Pay WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.15.0

Findings

2

Worst severity

high

Content hash

578838b5f0bb1182ec620453… Copy

Findings

• high Stored admin XSS via unsanitized custom payment method name

  xss_stored

  Custom method names are stored as trim($_POST['wc_gateway_name']) with no sanitize_text_field/esc_html. gateways_table_setting later echoes $gateway_title (settings title or $gateway->name) and $gateway_settings['gateway_icon'] into the IceNox Pay methods table without escaping. Because the write path is the unauthenticated constructor in the sibling finding, a guest can POST wc_gateway_name=<img src=x onerror=...> (form maxlength 32 is HTML-only and not enforced in PHP) and execute JavaScript in a shop_manager/administrator browser when they open WooCommerce → Settings → IceNox Pay. That session can then save icenox_pay_api_key to an attacker key (payment hijack) via the legitimate WooCommerce settings form. Even after the constructor is gated, the table still needs escaping because manage_woocommerce users can create names.

  includes/classes/class-icenox-pay-settings-page.php:415-434

  Recommendation

  Sanitize names with sanitize_text_field on write. Escape $gateway_title and created_by with esc_html, and gateway_icon with esc_url, on output. Do not render unsanitized option JSON into admin HTML.

• high Subscriber SSRF and attachment creation via get-attachment-by-url AJAX

  ssrf

  wp_ajax_get-attachment-by-url is registered for every logged-in user with no capability check (should be upload_files / manage_woocommerce) and no nonce check. ajax_get_attachment_by_url takes $_REQUEST['url'] raw, looks up or wp_insert_attachment's it, then for URLs whose string matches an svg extension calls generate_svg_metadata → get_svg_dimensions → file_get_contents($file_url). file_get_contents bypasses WordPress wp_http_validate_url (no private/loopback/link-local block), so a Subscriber or WooCommerce Customer can POST action=get-attachment-by-url&url=http://169.254.169.254/latest/meta-data/?x=.svg (or http://127.0.0.1:PORT/x.svg) and force the site to fetch attacker-chosen URLs, including cloud metadata and intranet services. Non-SVG URLs still create an attachment and pass the URL into wp_generate_attachment_metadata. The SVG body is parsed only for width/height, so this is authenticated blind SSRF plus unrestricted attachment creation and CSRF (media picker JS may send a nonce; PHP never verifies it). Unauthenticated users cannot hit wp_ajax_ (no nopriv).

  includes/classes/class-icenox-pay-method-icon-handler.php:6-37

  Recommendation

  Require current_user_can('upload_files') (or manage_woocommerce) and check_ajax_referer. Validate the URL with wp_http_validate_url / wp_safe_remote_get instead of file_get_contents. Do not create attachments from arbitrary remote URLs; restrict to the media library or an allowlisted CDN.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.