Low-severity findings only.

Audited release

4.2.2

Findings

1

Worst severity

low

Content hash

a511e7537ef15da99782754c… Copy

Findings

• low Client-supplied conditional-fields list can exclude amount fields from payment total

  unsafe_input

  get_values_by_tag() drops any field whose name appears in the JSON array posted as _wpcf7cf_hidden_group_fields, which is meant for the Conditional Fields for CF7 plugin. The value is trusted from $_POST even when that plugin is not installed and regardless of the form's actual conditions. On forms whose total combines a fixed fee field with other amount fields, a visitor can post the fee field's name in this list so it contributes 0 to the Pronamic payment total.

  src/SubmissionHelper.php:120-156

  Recommendation

  Only honour hidden-group data when Conditional Fields is active, and recompute visibility server-side from the form's conditions instead of trusting the posted list. Merchants should reconcile the paid amount against expected fees.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.