High-severity findings.

Audited release

0.1.4

Findings

3

Worst severity

high

Content hash

d1bbc9ef18ee6590da272e85… Copy

Findings

• high Cashiers can rewrite completed POS sale payment methods and cash movements without a REST nonce

  missing_capability

  POST /wp-json/mx-pos/v1/sales/{id}/payment-method is registered with a permission_callback that returns true for current_user_can('mx_pos_sell'|'mx_pos_manage_cash'|'manage_woocommerce') or any active POS employee cookie. It never calls RestSecurity::verify_mutation, so there is no X-WP-Nonce check. POS employees are not WordPress users; rest_cookie_check_errors therefore skips core cookie-nonce enforcement. POSCapabilityBridge grants mx_pos_sell to every POS employee (including cashiers) in mx-pos/v1 context. The handler then loads any completed, non-refunded mx_pos_sales row by POS id or wc_order_id, overwrites the WooCommerce order payment method/title and related meta, updates mx_pos_order_payments and payment_summary, and creates or zeros the matching mx_pos_cash_movements row. A cashier (or anyone with a stolen mx_pos_auth_token) can convert a cash sale to card (or the reverse) on any register, falsifying the cash-drawer expected total. SameSite=Lax on the POS cookie reduces cross-site CSRF, but same-origin CSRF and direct authenticated calls remain.

  includes/API/PaymentMethodCorrectionController.php:36-59

  Recommendation

  Require RestSecurity::verify_mutation with a manager-level cap (e.g. mx_pos_refund or mx_pos_manage_settings), restrict corrections to the caller’s open session (or an admin override), and keep cash-movement writes inside CashMovementService so they cannot be silently neutralized.

• medium X-cut endpoint discloses any open cash session with no ownership check

  information_disclosure

  GET /wp-json/mx-pos/v1/sessions/{id}/cuts/x is gated only by current_user_can('mx_pos_cash_cut'). POSCapabilityBridge grants that cap to all POS employees. CashCutService::generate_x loads the session by id and, if status is open, returns the full cash summary (opening amount, expected cash, sales, refunds, movements) plus printable ticket HTML. Unlike close_session, there is no session-owner comparison. A cashier on register 1 can enumerate session ids and read register 2’s live drawer. GET needs no plugin nonce; cookie-only POS employees also skip core REST nonce.

  includes/Cash/CashCutService.php:38-64

  Recommendation

  Require the caller to own the open session (same check as CashSessionService::close_session) unless the user has manage_options / mx_pos_view_audit, and keep listing endpoints scoped the same way.

• medium POS customer update can modify non-customer WordPress users including shop managers

  missing_capability

  PUT /wp-json/mx-pos/v1/customers/{id} is allowed to anyone with mx_pos_sell (cashiers via POSCapabilityBridge) after RestSecurity nonce. CustomerLookupService::update refuses only manage_options and mx_pos_manage_settings. Shop Manager has mx_pos_access but not those caps, so they are treated as editable. Editors and authors also pass because their roles lack manage_options. The handler then calls wp_update_user (display_name, first_name, last_name) and overwrites billing_first_name / billing_last_name / billing_phone. A POS cashier can rename a Shop Manager or Editor from the POS UI.

  includes/Customers/CustomerLookupService.php:246-270

  Recommendation

  Allow POS profile edits only for users whose sole/primary role is customer (or a dedicated POS-customer flag). Deny shop_manager, mx_pos_access, and any role with edit_posts / manage_woocommerce.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.