High-severity findings.

Audited release

2.0.0

Findings

2

Worst severity

high

Content hash

a2cde0d2217e57567955c01a… Copy

Findings

• high Unauthenticated domain-purchase webhook updates site options with no signature

  missing_auth

  GoLive registers rewrite tag wme-sitebuilder-domain-purchase-webhook on init and, on template_redirect, treats a non-empty query var as a webhook. handleWebhook() reads php://input, json_decodes it, and if action is the literal 'domain:add' and outcome.status is 'success', writes outcome.details.purchased_domain into option _sitebuilder_go_live (key purchased_domains) and fires domain_purchase telemetry/completed actions. isValidWebhookPayload() only checks that those JSON keys exist — no HMAC, shared secret, capability, nonce, or source IP. The query var is public (query_vars filter), so /?wme-sitebuilder-domain-purchase-webhook=true works even if permalinks were never flushed. An unauthenticated caller can therefore pollute go-live wizard state (and any parent hook on wme_event_wizard_completed) with arbitrary purchased_domain values. Domain rename itself (finish → Domain::renameDomain → siteurl/home) still requires manage_options and a POSTed domain, so this is not unauth site takeover by itself.

  Wizards/GoLive.php:104-330

  Recommendation

  Authenticate webhook deliveries with a high-entropy secret (HMAC of the raw body or a Bearer token) that is not guessable from the public URL. Reject unsigned or mismatched payloads before any update_option. Do not fire wizard-completed actions until the signature verifies. Optionally bind the callback to a per-purchase nonce created in createPurchaseFlow and rotate it after use.

• medium Privileged setup AJAX is nonce-only with no capability check in the dispatcher

  missing_capability

  UsesAjax::maybe_register_ajax_action hooks wp_ajax_{$ajax_action} (any logged-in user) and action__wp_ajax verifies only wp_verify_nonce($_REQUEST['_wpnonce'], $this->ajax_action) before do_action of the sub_action. There is no current_user_can in the dispatcher. FirstTimeConfiguration::finish (sitebuilder-wizard-ftc), StoreSetup::finish (sitebuilder-wizard-store-setup), LookAndFeel::finish (sitebuilder-wizard-lookandfeel), GoLive::checkPurchaseStatus, validateUsername, and telemetry sub-actions likewise omit a capability check. FTC finish writes blogname, blogdescription, and site_logo and can wp_set_password / change user_login for the current user; StoreSetup finish writes WooCommerce store address/currency/country. The nonce is only printed via ajax_props() on manage_options admin pages, so a Subscriber cannot mint a usable nonce from this plugin's UI — this is missing authorization, not a demonstrated customer BAC. Domain rename, plugin install, and payment get_keys already check manage_options or install_plugins in-handler.

  Concerns/UsesAjax.php:42-86

  Recommendation

  In action__wp_ajax, require current_user_can('manage_options') (the same cap as the admin menu) before dispatching any sub_action. Keep the nonce check. Mirror the cap check inside FirstTimeConfiguration::finish, StoreSetup::finish, LookAndFeel::finish, and GoLive::checkPurchaseStatus so a future dispatcher change cannot skip it.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.