PayTabs - WooCommerce Payment Gateway WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

5.10.1

Findings

1

Worst severity

high

Content hash

7844dc1cb6a8bf648a441034… Copy

Findings

• high Always-on PayTabs debug log is web-accessible and leaks order keys and customer PII

  information_disclosure

  Every PaytabsHelper::log() call writes to WP_CONTENT_DIR/debug_paytabs.log via error_log(..., 3, PAYTABS_DEBUG_FILE). There is no merchant on/off switch. The path is documented in README.md as /wp-content/debug_paytabs.log and defined as PAYTABS_DEBUG_FILE_URL = home_url + '/wp-content/debug_paytabs.log'. After a hosted-page Return, handle_response logs the full $order->get_checkout_order_received_url() (WooCommerce appends key={order_key}); an unauthenticated GET of that URL renders the order-received page with billing PII and line items. Failed create_pay_page logs json_encode($values), which includes customer_details (name, email, phone, street, city, country). Invalid HMAC attempts log the first hyphen-separated segment of server_key. Protection is an Apache-2.2 <Files debug_paytabs.log> Order/Deny block appended to wp-content/.htaccess on activation (or after a curl HEAD of the log URL that is not 403). That rule is ignored by nginx and IIS and by Apache with AllowOverride None; the plugin never uses WooCommerce's hashed wc-logs directory. Observable: GET /wp-content/debug_paytabs.log on a typical nginx host returns the log; extracted order-received URLs open other customers' thank-you pages without logging in.

  includes/paytabs_functions.php:20-89

  Recommendation

  Stop writing logs under the document root. Use wc_get_logger() (files in wc-logs with a random suffix, already denied by WooCommerce's htaccess) or a path outside the web root. Do not log order-received URLs, order keys, full API request bodies, or any slice of server_key. Gate debug logging behind an admin checkbox defaulting to off. If a deny file is kept, emit Apache 2.4 'Require all denied' plus a web.config, and never treat a curl 403 on one request as durable protection.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.