OrangerDev - Biteship WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.0.2

Findings

2

Worst severity

high

Content hash

eff9c20f9c31e8e8d85787da… Copy

Findings

• high Admin Biteship order AJAX shares ajax-nonce with checkout; no current_user_can on create/pickup/status

  missing_capability

  ordv_biteship_action_biteship_create_order, set_pickup_time, and get_data_status only verify wp_verify_nonce(..., 'ajax-nonce'). The same nonce action is localized to frontend checkout_ajax for Customers (class-ordv-checkout.php). Any logged-in Customer who visited checkout obtains a valid ajax-nonce and can POST action=biteship_create_order with arbitrary order id i, causing Biteship API order creation, order meta writes (order_biteship_id), and status changes to wc-waiting-delivery. Shop Manager screens also lack an explicit capability check beyond nonce. Observable: Customer POST admin-ajax.php action=biteship_create_order&nonce=…&i=ORDER_ID.

  admin/class-ordv-biteship-admin.php:365-394

  Recommendation

  Use distinct nonce actions for admin vs checkout. Require current_user_can('edit_shop_orders') on create/pickup/status handlers. Do not reuse checkout ajax-nonce for privileged fulfillment.

• high Biteship webhook REST route missing permission_callback and has no shared-secret check

  missing_permission_callback

  register_rest_route biteship-webhook/v1/update-order registers POST with callback ordv_update_order_callback and no permission_callback. The callback reads php://input JSON, looks up orders by order_biteship_id, and update_post_meta / update_status without verifying any Biteship signature or secret. On WP <5.5 this is fully public; on WP 5.5+ missing permission_callback is denied by core, but the handler itself is still unauthenticated if the route is ever opened. Observable: forged webhook body with known tracking id can set no_resi / status meta (and would flip order status if status_code fields were populated).

  public/class-ordv-check-awb.php:297-305

  Recommendation

  Add permission_callback validating a configured webhook secret/HMAC. Reject unauthenticated calls explicitly.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.