Critical findings.

Audited release

2.1.0

Findings

2

Worst severity

critical

Content hash

3cc1edcbef46a8026e5d0469… Copy

Findings

• critical Payment confirmation mismatch on thank-you page

  auth_bypass

  thankyou_page loads transaction details using pesapal_merchant_reference and pesapal_transaction_tracking_id from $_GET, then if status === COMPLETED calls $order->payment_complete() on the thank-you $order_id without asserting that the merchant reference equals this order ID (or that paid amount matches). A customer with two orders can pay a cheap order and replay its Pesapal GET parameters on the expensive order's order-received URL to mark it paid.

  gateway.php:323-360

  Recommendation

  Require (string)$pesapalMerchantReference === (string)$order_id (or stored reference), verify paid amount/currency against the order total, and ignore GET status unless it matches the server-side Pesapal query for that same reference. Prefer IPN/background verification only.

• medium TLS certificate verification disabled for Pesapal API calls

  insecure_config

  curlRequest sets CURLOPT_SSL_VERIFYPEER to 0 when querying payment status/details. A network attacker can MITM Pesapal responses and influence COMPLETED/FAILED decisions used by IPN and thank-you flows.

  gateway.php:635-643

  Recommendation

  Enable CURLOPT_SSL_VERIFYPEER (and VERIFYHOST) and use WP HTTP API with sslverify true.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.