Medium-severity findings.

Audited release

0.1.8

Findings

3

Worst severity

medium

Content hash

efb88b18ddaa096e6e448be8… Copy

Findings

• medium Unescaped Odoo error log in admin table (stored XSS via anonymous form submissions reflected in Odoo faults)

  xss_stored

  OdooConnCustomTableDeletableDisplay::column_default() returns raw column values, and the Odoo Errors list table has no escaping column method for error_message. Error rows are inserted by cf7hook.php log_error() from OdooConnException messages, which carry the Odoo XML-RPC faultString produced while processing values posted by anonymous Contact Form 7 visitors. Odoo validation faults commonly quote the offending value, so a visitor can submit markup that is stored and later executed in an administrator's wp-admin session. Exploitability depends on the mapped Odoo field types producing a reflecting fault, hence medium rather than high.

  admin/table_display.php:108-111

  Recommendation

  Escape all list-table output (return esc_html( $item[ $column_name ] )) and escape contact_7_title in column_contact_7_title(); optionally sanitize fault strings before storing.

• medium Bulk delete of connections/forms/mappings/errors executes on GET without nonce (CSRF)

  csrf

  OdooConnPageRouter::display_table() calls $this->table_display->check_bulk_action(), which deletes every id in $_REQUEST['element'] when current_action() is 'delete_bulk'. The nonce check in OdooConnPageRouterCreate::verify_nonce() only runs for POST requests, and the errors router has no nonce check at all, so a GET link sent to a logged-in administrator deletes Odoo connections, form definitions or field mappings, breaking the CF7->Odoo pipeline.

  admin/table_display.php:55-68

  Recommendation

  Call check_admin_referer('bulk-' . $this->_args['plural']) inside check_bulk_action() before deleting, and only process deletions on POST.

• low Encryption key for stored Odoo API keys written to web-accessible plugin directory

  information_disclosure

  OdooConnEncryptionFileHandler writes the libsodium secretbox key to wp-content/plugins/odoo-wp-plugin/odoo_conn.key with no .htaccess/index protection, so on typical servers anyone can download it. Combined with any database read (backup leak, SQLi elsewhere) the encrypted Odoo API keys can be decrypted.

  encryption.php:9-37

  Recommendation

  Derive the key from wp_salt()/a wp-config constant or store it outside the webroot; at minimum deny web access to the key file.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.