Custom Invoices WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.9

Findings

1

Worst severity

high

Content hash

f452e9d171f720fb22c38ef9… Copy

Findings

• high Send invoice email AJAX lacks capability check

  missing_capability

  ajax_send_order_email verifies send_invoice_email_nonce but never calls current_user_can. Any authenticated user who obtains that nonce (or after a future nonce leak/XSS) can trigger wp_mail of order invoice PDF attachments to the billing email and add an order note. Sibling attachment update AJAX correctly requires edit_shop_orders/manage_woocommerce.

  includes/class-custom-invoices-email-sender.php:23-35

  Recommendation

  Require current_user_can( 'edit_shop_orders' ) or manage_woocommerce before sending, matching ajax_update_attachments.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.