WP Manifestindependent plugin directory
manifest / ecommerce / woocommerce-paysafecard

WooCommerce paysafecard Gateway WP RegistryMedium-severity findings · 2 findingsOpen the reportB

paysafecard as payment method in WooCommerce/Wordpress

by Laurens Kropf · github.com/laurensk/woocommerce-paysafecard · website

★ 5stars
34release downloads
v0.2-devlatest · never

Install

Download woocommerce-paysafecard-v0-2.zip From the v0.2-dev release on GitHub, Dec 4, 2019

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/laurensk/woocommerce-paysafecard/releases/download/v0.2-dev/woocommerce-paysafecard-v0-2.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/laurensk/woocommerce-paysafecard ↗

WooCommerce/WordPress Plugin to use paysafecard as payment method.

To use this plugin, you have to upload it to the wp-plugins folder of your WordPress installation. You can find more information about this process on the internet. You then can set up the plugin with custom settings, such as API-Key and extra amount when paying with paysafecard.

Note: I don’t recommend using this plugin in production. Please consider forking it so everyone can profit.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.2-dev latest
Dec 4, 2019 6 years ago
woocommerce-paysafecard-v0-2.zip
22
v0.1-dev
Dec 4, 2019 6 years ago
woocommerce-paysafecard.zip
12
B grade

Security

WooCommerce paysafecard Gateway 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
1.0.0
Findings
2
Worst severity
medium
Content hash
6ce4af0a2e5ea27638138936…

Findings

  • medium TLS certificate verification disabled for paysafecard API

    insecure_config

    PaysafecardPaymentController::doRequest sets CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST to false, enabling MITM of API key and payment traffic.

    PaymentClass.php:52-55

    Recommendation

    Enable peer/host verification (true/2) and use the system CA bundle.

  • low Unauthenticated callback stores full $_GET in webhook_debug option

    unsafe_input

    callback_handler always update_option('webhook_debug', $_GET), allowing unauthenticated callers to write arbitrary query data into an option.

    woocommerce-paysafecard.php:341-341

    Recommendation

    Remove debug option writes from production callbacks or restrict to WP_DEBUG with sanitization.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →