Mobbex Subscriptions for WooCommerce WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

3.5.1

Findings

1

Worst severity

high

Content hash

032b5ac1951dd18b8be1979f… Copy

Findings

• high Public WC-API retry endpoint charges stored cards with no auth or nonce

  missing_auth

  woocommerce_api_mbbxs_retry_execution is registered from Mbbx_Subs_Order_Settings::init and is reachable by any visitor at /wc-api/mbbxs_retry_execution or ?wc-api=mbbxs_retry_execution. retry_execution_endpoint() reads order_id and execution_id from $_REQUEST and calls Mbbxs_Helper::retry_execution(), which authenticates to api.mobbex.com with the merchant x-api-key / x-access-token and GETs /subscriptions/{id}/subscriber/{sid}/execution/{eid}/action/retry. There is no current_user_can, wp_verify_nonce, or mobbex_token check. Admin JS localizes that public URL (order-admin.js POST). Anyone who knows a failed execution UID (sequential order_id plus UID from a prior webhook, SQLi, or admin CSRF) can re-bill the subscriber's stored payment method. This is independent of the webhook token.

  includes/admin/order-settings.php:19-27,163-187

  Recommendation

  Do not expose retry on woocommerce_api_ (public IPN channel). Use admin-ajax or admin-post with current_user_can('edit_shop_orders') and check_ajax_referer(). Never send merchant API credentials to Mobbex based on unauthenticated request parameters.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.