Woocommerce Cargonizer WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.5.4

Findings

1

Worst severity

high

Content hash

9921552e741dd93b891b08b6… Copy

Findings

• high Shop order consignment/print AJAX lacks capability and nonce

  missing_capability

  wcc_create_consignment, wcc_print_order, wcc_print_latest_consignment, edit, delete are wp_ajax_* only (logged-in) but have no current_user_can or check_ajax_referer. Any authenticated user can create consignments or print labels for arbitrary order_id.

  admin/CargonizerAjax.php:6-11,80-145

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.