WP Manifestindependent plugin directory
manifest / developer / woocommerce-square-helper

WooCommerce Square Helper WP RegistryMedium-severity findings · 1 findingOpen the reportB

by WooCommerce · github.com/jessepearson/woocommerce-square-helper · website

★ 2stars
1.0.6latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jessepearson/woocommerce-square-helper/archive/refs/heads/trunk.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/jessepearson/woocommerce-square-helper ↗

WooCommerce Square Helper

What's this?

At present the Square Helper tool has these functions:

  1. Manually sync a single product or variation's inventory with Square.
  2. Update sync limits.
  3. Kicker!

It is set up to be able to add more functionality when needed.

How do these help?

  1. Sometimes sites break, and this can fix the inventory of single items at a time, if needed.
  2. If a site is timing out, this makes it possible to lower (or raise) the limits on what's queried from Square at a time. Values are saved in the database, then applied via filters.
  3. The kicker sets up a scheduled action to kick the sync if it has gotten stuck.

Setup

  1. Install the plugin.
  2. Go to Tools > Square Helper.

Releases

3 releases.

Tag
Published
1.0.6 latest
Apr 13, 2021 5 years ago
1.0.1
Jun 2, 2020 6 years ago
1.0.0
May 29, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WooCommerce Square Helper 1.0.6 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.6
Findings
1
Worst severity
medium
Content hash
ac5debe8cffdc7f7eb6f8880…

Findings

  • medium Square Helper admin actions lack capability check

    csrf

    catch_requests verifies nonce for sync_product/sync_limits/sync_kicker but never calls current_user_can. Combined with missing Referer checks this is classic admin CSRF to change sync limits or toggle kicker.

    woocommerce-square-helper.php:199-238

    Recommendation

    Add current_user_can('manage_options') after nonce verification before processing actions.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →