High-severity findings.

Audited release

3.2.0

Findings

3

Worst severity

high

Content hash

9637cd203d86a9122a9e5d17… Copy

Findings

• high IMAP reconcile marks Venmo orders paid from unauthenticated mailbox mail with no sender check

  auth_bypass

  When the merchant saves IMAP credentials on WooCommerce → Payments → Venmo, BH_WP_Mailboxes cron (hourly venmo-payment-emails_fetch_emails_job, also the CPT 'Check now' AJAX) fetches INBOX mail and fires bh_wp_mailboxes_fetch_emails_saved_bh-wc-venmo-gateway. Settings for this plugin set get_from_email_regex() to null (explicitly 'Do not filter to a specific email address') and get_identifier_regex() to only /https:\/\/venmo.com\//, so any From: address is accepted if the body mentions that URL. Email_Parser then runs Pattern_2 HTML regexes (<!-- actor name -->, <!-- note --><p>…</p>, $N.NN</span>, Payment ID) on attacker-controlled HTML. Email_Reconciler treats every digit run in that note as an order id when exactly one number is present, or falls back to billing/shipping full name; match_email_to_order() calls payment_complete() when the order is unpaid and get_total() === parsed amount. A guest who placed a Venmo order already knows order id and total (printed on the thank-you page and in the on-hold email). If they can deliver a message to the configured inbox — often the same address as the store contact/Venmo-account email — they complete that order without paying Venmo. Transaction URL/note from the same mail are written into admin order notes without escaping (Pattern_1 transaction_url is an open https.* capture).

  includes/api/class-settings.php:193-205

  Recommendation

  Require the receipt From: address (and/or DKIM/SPF) to match Venmo's sending domains before parsing. Do not treat an arbitrary inbox message that merely contains https://venmo.com/ as a settlement. Bind matches to the customer Venmo username collected at checkout plus amount and a signed order token, not billing name or an unauthenticated note. Escape order-note HTML built from email captures.

• high IMAP fetch disables TLS certificate validation, so MITM can inject payment receipts

  insecure_config

  Ddeboer_Imap_Email_Fetcher::get_server() constructs the IMAP connection with flags /imap/ssl/novalidate-cert. The bundled Ddeboer Server default is /imap/ssl/validate-cert; this plugin wrapper deliberately turns validation off (TODO: 'Add option in settings'). The store therefore accepts any certificate for the configured email_server when the hourly fetch (or Check now) runs. A network-position attacker (shared host, rogue DNS, compromised hop) can present a fake IMAP INBOX containing Pattern_2 HTML. Those messages take the same Email_Reconciler path and payment_complete() unpaid Venmo orders. Combined with get_from_email_regex() === null there is no second factor that the mail originated at Venmo.

  vendor-prefixed/brianhenryie/bh-wp-mailboxes/src/API/Ddeboer_Imap/class-ddeboer-imap-email-fetcher.php:86-89

  Recommendation

  Use the library default /imap/ssl/validate-cert (or php_openssl CA verification). Fail closed on certificate errors. Do not expose novalidate-cert as a silent default.

• medium Venmo receipt emails stored as a CPT with default post capabilities

  information_disclosure

  BH_Email_CPT::register_cpt() registers venmo_payment_emails (from 'Venmo Payment Emails') with public=false, show_ui=true, show_in_menu=false, show_in_rest=false, and no custom capabilities. A commented TODO shows the intended map (publish/delete/read_private → update_core) was never enabled, so capability_type remains post. Fetched receipts are wp_insert_post'd with post_status publish and post_content = the plain-text body (payer name, amount, note); cron runs as user 0. An Editor (edit_others_posts) who requests wp-admin/edit.php?post_type=venmo_payment_emails can list and open every receipt. The same screen prints the mailboxes Check now nonce, so that Editor can also invoke wp_ajax_bh_wp_mailboxes_check_email (nonce only, no current_user_can) and trigger IMAP fetch plus reconciliation. Subscribers cannot reach this UI.

  vendor-prefixed/brianhenryie/bh-wp-mailboxes/src/WP_Includes/class-bh-email-cpt.php:82-113

  Recommendation

  Map the CPT to manage_woocommerce or manage_options (the commented update_core block). Keep show_in_menu false. Require current_user_can('manage_woocommerce') in Ajax::check_email in addition to the nonce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.