High-severity findings.

Audited release

0.3.2

Findings

4

Worst severity

high

Content hash

36baeda6d8de46b46c9ca841… Copy

Findings

• high Subscriber stored XSS via coupon insert/update AJAX rendered unescaped in wp-admin

  xss_stored

  wp_ajax_nhymxu_coupons_ajax_insertupdate and wp_ajax_nhymxu_coupons_ajax_checkcoupon accept $_POST['coupon_data'] with no capability, nonce, or sanitization. coupon_insert()/coupon_update() write type/title/code/exp/note/url/save through $wpdb->insert/update as %s (no kses). The admin list (Nhymxu_AT_Coupon_List::column_default and column_title) returns those fields raw; column_title also concatenates $item['code'] into onclick="nhymxu_delete_coupon('ID','CODE')", and the add/edit form echoes $default_data['title'|'code'|'note'|'url'|'save'] into input value attributes without esc_attr. A Subscriber can plant <img src=x onerror=alert(document.domain)> (no quotes needed, so magic quotes are irrelevant) in title/note. When an administrator opens wp-admin/admin.php?page=accesstrade_coupon (or the edit screen), the payload runs in the admin origin — session riding to create users or install plugins. On every working install the required companion nhymxu-at-coupon shortcode template also echoes title/note/code and the deeplink URL unescaped on the public site, so the same write is visitor-facing stored XSS wherever [coupon type="…"] is used (merchant is not server-allowlisted, so the attacker can match a live shortcode type). Observable: POST action=nhymxu_coupons_ajax_insertupdate with coupon_data[cid]=0, coupon_data[title]=<img src=x onerror=alert(document.domain)>, plus merchant/url/exp; then load the Smart Coupons list as admin.

  admin.php:24-65

  Recommendation

  Gate insert/update/check AJAX with current_user_can('manage_options') and a nonce. Sanitize on write (sanitize_text_field / esc_url_raw) and escape on output (esc_html in table cells, esc_attr in input values, esc_js in onclick). Server-side allowlist merchant against nhymxu_at_coupon_merchants.

• high All coupon AJAX actions are missing capability and nonce checks

  missing_capability

  Six wp_ajax_* actions are registered with no permission_callback equivalent: nhymxu_coupons_ajax_insertupdate, nhymxu_coupons_ajax_checkcoupon, nhymxu_coupons_ajax_deletecoupon, nhymxu_coupons_ajax_bulkdeletecoupon, nhymxu_coupons_ajax_forceupdate_merchants, nhymxu_coupons_ajax_forceupdate_categories. Core only requires is_user_logged_in for wp_ajax_*. ajax_delete_coupon() takes $_POST['cid'] and $wpdb->delete()s that coupon and its category rows. ajax_force_update_merchants() calls do_this_daily() which uses the stored AccessTrade accesskey (Authorization: Token …) and overwrites option nhymxu_at_coupon_merchants. ajax_force_update_categories() fetches http://sv.isvn.space/api/v1/mars/category and INSERTs coupon_categories. Combined with the SQLi/XSS findings, a Subscriber can create, modify, or wipe the coupon catalog, force outbound API calls with the site’s AccessTrade secret, and replace the merchant map used by the add-new UI. No nonce means any same-site script running as a logged-in user can also fire them. Observable: Subscriber POST action=nhymxu_coupons_ajax_deletecoupon&cid=1 returns ok and removes that row; POST action=nhymxu_coupons_ajax_forceupdate_merchants returns running and rewrites nhymxu_at_coupon_merchants.

  admin.php:6-11

  Recommendation

  Add current_user_can('manage_options') and check_ajax_referer (unique action per handler) at the top of every AJAX callback, or do not register the actions for users who cannot manage_options. Keep merchant/category force-sync on the settings page behind the same cap+nonce.

• high Plugin updates fetched over cleartext HTTP from sv.isvn.space with unsigned download_url

  insecure_config

  init_updater() (on init when is_admin()) constructs nhymxu_AT_AutoUpdate with $this->endpoint_plugin_update = http://sv.isvn.space/wp-update/plugin-accesstrade-coupon-pro.json. check_update() on pre_set_site_transient_update_plugins calls getRemote(), which wp_remote_get()s that URL with no TLS pin, no signature, and a buggy success check (!is_wp_error($request) || status===200 — any non-error response is trusted). json_decode(body) supplies version, homepage, download_url, and tested; if version_compare says the remote is newer, that download_url is placed in the update transient as the plugin package. An on-path attacker (or anyone who later controls sv.isvn.space — the plugin is explicitly unmaintained since ~2018 and still phones this host) can serve version 99.0 plus a zip of PHP that WordPress will install when an administrator clicks Update Plugin. getRemote_default() still contains @unserialize($request['body']) but is unused. Observable: MITM the HTTP GET for plugin-accesstrade-coupon-pro.json, return a larger version and a attacker-controlled download_url; Plugins screen offers the update; installing it executes attacker PHP as the site.

  nhymxu-updater.php:74-122

  Recommendation

  Serve the update manifest and zip only over HTTPS with certificate validation, sign the payload, and verify the signature before writing the update transient. Fail closed on non-200 responses (fix the || vs &&). Disable the custom updater and instruct users to install from a trusted source; this repo is declared unmaintained.

• medium AccessTrade credentials saved from the settings form with no nonce

  csrf

  admin_page_callback_settings() is the manage_options submenu callback for accesstrade_coupon_settings. If $_POST['nhymxu_hidden']==='coupon' it sanitizes uid/accesskey/utmsource from $_REQUEST, update_option('nhymxu_at_coupon', $input), clears nhymxu_at_coupon_merchants, and immediately calls do_this_daily() with the new Token. There is no check_admin_referer / wp_nonce_field. A same-origin POST (or a browser that still sends the auth cookie on cross-site POST) from a logged-in administrator overwrites the AccessTrade publisher id and access key used to build affiliate deeplinks and to authorize api.accesstrade.vn. That is commission theft, not just a cosmetic flag. Observable: while an administrator is logged in, POST admin.php?page=accesstrade_coupon_settings with nhymxu_hidden=coupon and attacker uid/accesskey; get_option('nhymxu_at_coupon') matches the attacker and subsequent coupon links credit their AccessTrade account.

  admin.php:244-258

  Recommendation

  Add wp_nonce_field on the settings form and check_admin_referer (plus the existing manage_options gate) before update_option. Do not read these fields from $_REQUEST.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.