High-severity findings.

Audited release

1.1.7

Findings

4

Worst severity

high

Content hash

829cf34acfcfeae9d87b1b7b… Copy

Findings

• high Missing capability and nonce on Omniva shipment AJAX (any logged-in user)

  missing_capability

  create_order, load_order, and delete_order are hooked only to wp_ajax_* (authenticated) but perform no current_user_can('edit_shop_orders') or check_ajax_referer. A Subscriber can create Omniva international shipments, load admin metabox HTML for arbitrary orders, or delete shipments, abusing the store's Omniva API credentials.

  classes/Order.php:213-246

  Recommendation

  Require current_user_can('edit_shop_orders') (or manage_woocommerce) and check_ajax_referer before mutating shipments. Validate the order uses Omniva shipping.

• high Missing capability and nonce on Omniva shipment AJAX (any logged-in user)

  missing_capability

  create_order, load_order, and delete_order are hooked only to wp_ajax_* (authenticated) but perform no current_user_can('edit_shop_orders') or check_ajax_referer. A Subscriber can create Omniva international shipments, load admin metabox HTML for arbitrary orders, or delete shipments, abusing the store's Omniva API credentials.

  classes/Order.php:213-246

  Recommendation

  Require current_user_can('edit_shop_orders') (or manage_woocommerce) and check_ajax_referer before mutating shipments. Validate the order uses Omniva shipping.

• medium Terminals/services sync AJAX missing capability and nonce

  missing_capability

  wp_ajax_omniva_terminals_sync and wp_ajax_omniva_services_sync call the Omniva API with no current_user_can or nonce check. Any logged-in user can trigger remote sync and abuse API credentials.

  classes/Main.php:264-281

  Recommendation

  Require manage_woocommerce/edit_shop_orders and check_ajax_referer.

• medium Print label GET action lacks nonce (CSRF for shop managers)

  csrf

  Manifest::execute_outside_action and Order::print_label print labels when omniva_global_action/omniva_global_label is set for users with edit_shop_orders in admin, without a nonce. An attacker can CSRF a logged-in shop manager into printing/fetching labels for attacker-chosen shipment IDs.

  classes/Manifest.php:67-82

  Recommendation

  Require wp_nonce_url / check_admin_referer on print_label links.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.