GoCuotas WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.6.0.3

Findings

1

Worst severity

medium

Content hash

95c1590a6faabcfead5b46c4… Copy

Findings

• medium Unauthenticated checkout-icon upload via admin_init

  missing_capability

  GoCuotas_Helper::uploadIcon is hooked to admin_init with no current_user_can and no nonce. WordPress runs admin_init on wp-admin/admin-ajax.php (after a non-empty action) and wp-admin/admin-post.php before those files decide whether the user is logged in. An unauthenticated multipart POST of field woocommerce_gocuotas_iconfile therefore stores the file with wp_upload_bits and update_option('go_cuotas_icon', $upload['url']). Checks only limit size to 100KB, mime_content_type to image/png, and getimagesize width to 100px; they do not authenticate. go_cuotas_icon is the payment-method / installment badge: WC_Gateway_GoCuotas sets $this->icon from it, show_logo() concatenates it into product price HTML on is_product()/is_checkout() when show_icons is yes (default), and the Blocks integration passes it as img src. Anyone on the internet can replace the storefront GoCuotas logo with an attacker-controlled PNG in uploads (phishing/fake badge). Filename is still passed through wp_upload_bits/sanitize_file_name so this is not an arbitrary PHP upload or img-src XSS.

  includes/helpers/class-helper.php:10,23-55

  Recommendation

  Handle the icon only inside process_admin_options (or a dedicated admin-post action) after current_user_can('manage_woocommerce') and check_admin_referer on the WooCommerce settings nonce. Reject uploads unless is_admin() && current_user_can. Use wp_handle_upload with a strict image mimes map and do not read $_FILES on every admin_init.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.