Mixpakk Futárszolgálat és Webshoplogisztika WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.4.1

Findings

3

Worst severity

high

Content hash

518e337e29f29a2e329b633c… Copy

Findings

• high Any logged-in user can overwrite Mixpakk/Deliveo credentials and settings (stored admin XSS)

  missing_capability

  wp_ajax_save_api_key_and_licence is registered with no current_user_can() and no nonce. The callback calls save_mixpakk_settings(). If POST action=save_api_key_and_licence, that method copies unsanitized $_POST['api_key'] and $_POST['licence_key'] into option mixpakk_settings. If POST also contains mixpakk_settings (the settings-form submit flag), the same function json_encode()s the entire $_POST — sender, sender_address, delivery, delivered_status, freight, print_format, etc. — and update_option()s it, then the second branch still applies the new API keys. wp_ajax_ admits every logged-in role including WooCommerce customer/subscriber (WooCommerce's prevent_admin_access explicitly allows admin-ajax.php). Settings_page_content then prints those values into HTML attributes with no esc_attr (value="' . $settings['api_key'] . '" and the same for licence_key, sender, city, phone, email). A customer can therefore (1) replace the merchant Deliveo licence so subsequent Mixpakk::send_by_api / Mixpakk_API::send_order_items posts every fulfilled order's consignee PII to an attacker-controlled Mixpakk account and can rewrite sender identity, and (2) plant "><script> / event-handler payloads in api_key or sender. Breaking the integration is the lure: the shop admin opens WooCommerce → Mixpakk to restore the keys and executes the stored XSS (admin-session takeover). The same save_mixpakk_settings() path used by the settings form also has no check_admin_referer, so a manage_woocommerce user is CSRF-able on admin.php?page=mixpakk-settings. wp_login updateShippingOptions then refreshes shipping_options from whatever API the new keys point at, and those descriptions are concatenated into the orders-list <option> HTML.

  inc/mixpakk-settings.class.php:312-334

  Recommendation

  Require current_user_can('manage_woocommerce') and check_ajax_referer() on save_api_key_and_licence. Add check_admin_referer to the settings form POST. Allowlist and sanitize the keys you persist; never json_encode($_POST). Escape every setting with esc_attr/esc_html on output.

• high Customer-accessible AJAX leaks shipping labels, consignee PII, and writes public PDFs

  missing_capability

  label_download, view_signature, view_package_log, package_details, and mixpakk_generate_labels are wp_ajax_ only (no nopriv) but have no capability check and no nonce. Any logged-in customer can POST admin-ajax.php with those actions and the store's saved licence/api_key is used to call api.deliveo.eu. package_details echoes consignee_zip, consignee_city, consignee_address, consignee_apartment, consignee_phone, and consignee_email for whatever group_id is supplied. generate_labels takes $_POST['post'] order ids, reads _group_code, and returns a base64 shipping-label PDF in JSON. label_download / view_signature copy the PDF to wp_get_upload_dir()['path'] . '/' . $_POST['group_id'] . '.pdf' (and _sign.pdf) with no sanitization of group_id, so the file is published at the corresponding public uploads URL and group_id can path-traverse within the constraint of a .pdf suffix. admin.js inserts those HTML responses via jQuery .html() / .append() on the orders screen. handle_heartbeat is gated only by is_admin(), which is always true on admin-ajax.php, so a frontend-logged-in customer can send data[mixpakkPendingStatus][]={order_id} on wp_ajax_heartbeat and receive _group_code values to feed the other endpoints. Intended users are shop_manager/admin on the orders list; subscriber/customer/author/editor all share the same unguarded path.

  inc/mixpakk.class.php:497-691

  Recommendation

  Require current_user_can('edit_shop_orders') (or manage_woocommerce) and check_ajax_referer on every Mixpakk AJAX action. Restrict heartbeat group-code disclosure the same way. Sanitize group_id to a strict Deliveo id charset; store labels outside the public uploads tree or behind a capability-checked download. Do not echo API fields without escaping.

• high Reflected XSS in admin notices via mixpakk GET parameters

  xss_reflected

  Mixpakk::mixpakk_success_msg and Mixpakk_Filter::display_messages are hooked to admin_notices (every wp-admin screen, including a subscriber's profile.php). mixpakk_success_msg echoes $_GET['succeded'] and $_GET['failed'] when mixpakk_ok is present, and foreach-echoes $_GET['failed_messages'] and $_GET['warning_messages'] with no escaping. display_messages echoes $_GET['mxp_notices'][i]['msg'] into a <p> and interpolates ['type'] into class="notice notice-<?= $message['type'] ?>". A crafted URL such as /wp-admin/?failed_messages[]=<script>... or /wp-admin/?mxp_notices[0][type]=error"><img src=x onerror=...>&mxp_notices[0][msg]=<script>... executes in the victim's admin session when they open the link. wp_magic_quotes only slash-escapes quotes and does not stop script tags or HTML-attribute breakout (backslash is not an HTML escape). These query args are leftover from an older bulk-submit redirect and are still live; do_bulk_order_submit_option still redirects with mxp_notices on classic (non-HPOS) stores.

  inc/mixpakk.class.php:434-456

  Recommendation

  Stop reflecting request parameters in admin notices. Pass messages through a user meta/transient keyed to the current user, then esc_html() on output. If query args must remain, allowlist type and escape both type and msg.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.