Crypto Payments for WooCommerce by PayBear.io WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

0.9

Findings

1

Worst severity

high

Content hash

b72fc03522e23475b23fc8cc… Copy

Findings

• high Unauthenticated WC-API address/status endpoints mutate order meta and call PayBear with site API secret

  missing_auth

  GET ?wc-api=WC_Gateway_Paybear&address=TOKEN&order_id=N invokes get_currency_json → get_address, which uses the store's api_secret against PayBear and writes address/invoice/total meta for arbitrary pending order IDs. Unauthenticated visitors can burn API quota, force address generation, and learn payment amounts/addresses for enumerable order IDs.

  class-wc-gateway-paybear.php:591-598

  Recommendation

  Require order-key or logged-in purchaser authorization before generating addresses; rate-limit; never expose address minting on a guessable order_id alone.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.