High-severity findings.

Audited release

1.0.7

Findings

3

Worst severity

high

Content hash

81a372f6e2c970cfad2e9a49… Copy

Findings

• high Any user who can edit their profile can assign themselves an arbitrary membership rank

  missing_capability

  UserEdit hooks show_user_profile and personal_options_update, so the membership <select name="member_lv"> is rendered on the user's own profile and saved in update_fields. The only gate is current_user_can('edit_user', $user_id). WordPress map_meta_cap allows every logged-in user to edit themselves, so this is not an administrator check. The POST value is written unsanitized into _gamipress_member_lv_rank. MemberDiscount::apply_member_discount reads that meta as a post ID, loads power_membership_discount, and add_fee('會員折扣', -subtotal * percent/100) with no check that the post is member_lv. Coupon View::filter_condition_by_membership_ids also trusts gamipress_get_user_rank_id. A customer (when WooCommerce wp-admin lock is off) or any author/contributor (always has profile.php) can pick the highest published rank, skip the 12-month spend threshold, and receive that rank's cart discount plus membership-only coupons. They can also point the meta at a post they control whose discount meta was set to 100 via the save_post handler (see next finding). Users.php column set_users_column_values echoes get_the_title($member_lv_id) unescaped, so a malicious post title becomes stored XSS in the admin users list. Core profile nonce is present, so this is missing capability, not CSRF.

  inc/classes/Admin/Users/UserEdit.php:21-25,57-79,144-151

  Recommendation

  On show_user_profile hide or disable the rank field; only save it on edit_user_profile_update after current_user_can('edit_users') or manage_woocommerce. absint the post ID and verify get_post_type() === member_lv before update_user_meta. MemberDiscount must reject non-member_lv post IDs. Escape get_the_title() with esc_html in UserColumns.

• high save_post writes membership discount meta on every post type a user can edit

  missing_capability

  MemberLv\Metabox::save_metabox is hooked to save_post for all post types. After current_user_can('edit_post', $post_id) it always update_post_meta power_membership_threshold and power_membership_discount (0–100), even when those keys are absent from POST (defaults to 0). There is no post_type === member_lv check and no metabox nonce. An author can include power_membership_discount=100 on a normal post save (core update-post nonce they already have). MemberDiscount does not verify the rank post type: once UserEdit (or a crafted profile POST) sets _gamipress_member_lv_rank to that post ID, checkout applies a 100% 會員折扣 fee. The same handler also lets anyone with edit_post stamp discount/threshold meta onto products, pages, or shop_coupon posts. This is the write path for a checkout-pricing key that a generic XSS sweep would treat as admin-only metabox state.

  inc/classes/MemberLv/Metabox.php:34,85-98

  Recommendation

  Return unless $post->post_type is member_lv. Verify a metabox nonce and skip autosave/revisions. Only update meta when the keys are present in POST. MemberDiscount must confirm the ID is a published member_lv rank before applying a fee.

• high Unsanitized birthday user meta stored and echoed into the admin profile form

  xss_stored

  UserEdit::update_fields writes $_POST['birthday'] to user meta with no sanitize_text_field (unlike FrontEnd\Membership::save_birthday_field on the WooCommerce account form). add_fields echoes it into <input type="date" value="<?php echo $birthday; ?>"> without esc_attr. That is an HTML-attribute breakout on profile.php and user-edit.php. When PowerPlugins simple-admin is enabled, admin-user-edit.js copies the input's outerHTML and assigns it to #your-profile innerHTML, which executes event-handler payloads. A low-privileged user who can save their profile (author/contributor always; customer if wp-admin is not locked) plants the payload; an administrator viewing or editing that user runs it in wp-admin. WooCommerce's date field is not this sink — this plugin's admin profile is.

  inc/classes/Admin/Users/UserEdit.php:110-116,153-155

  Recommendation

  Sanitize with sanitize_text_field (and validate YYYY-MM-DD) on save. Echo with esc_attr. Do not rebuild the profile form with innerHTML of unsanitized field HTML.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.