PayPing PMPro WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

high

Content hash

49745cc1899f258277fe1af4… Copy

Findings

• high Unauthenticated payment callback is replayable: 'already verified' (409/110) grants membership again, with no order-status or single-use check

  missing_auth

  pmpro_wp_ajax_payping_ins() is registered for nopriv and trusts the JSON in $_REQUEST['data']. It never checks the _wpnonce it put in returnUrl or whether the order is already 'success'. When PayPing's verify answers 409 with metaData.code 110 (payment already verified), the handler calls do_level_up() again, which calls pmpro_changeMembershipLevel with startdate=now and a fresh enddate. A member who paid once can re-submit the same callback (same clientRefId/paymentCode/paymentRefId) at any time to renew or restore their level indefinitely without paying, and anyone who knows an order code can re-trigger level changes and admin/member checkout emails. The paymentCode and amount mismatch guards call wp_redirect() without exit, so they do not stop execution. do_level_up() also copies unsanitized $_POST first_name/last_name into the order owner's user meta. Separately, the amount sent to PayPing is intval($morder->subtotal) rather than total, so tax is never collected.

  includes/class-pmpro-payping-gateway.php:331-440

  Recommendation

  Exit after every error redirect. Refuse orders whose status is not 'pending' (idempotent: return the confirmation page without calling do_level_up). Treat 409/110 as success only if the order is still pending and the verified amount and refId match the stored values. Verify the nonce or a signed state value tied to the order. Charge $morder->total. Sanitize or drop the $_POST name writes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.