High-severity findings.

Audited release

1.2.4

Findings

1

Worst severity

high

Content hash

e17fdf59dcbf958a1f966cdc… Copy

Findings

• high Unauthenticated WooCommerce order-email disclosure via admin_init (no capability or nonce)

  missing_auth

  pwe_preview_email_page is hooked to admin_init and returns as soon as $_GET['pwe_preview_template'] is set. There is no is_user_logged_in, current_user_can('edit_shop_orders'|'manage_woocommerce'), or nonce check. It concatenates the raw query arg onto 'WC_Email_' and calls pwe_ajax_return_html_template(), which takes order_id from $_REQUEST, loads that WC_Order, and echoes the rendered email (recipient, subject, headers, HTML body). WordPress fires admin_init on admin-post.php and admin-ajax.php before auth_redirect / the is_user_logged_in ajax split, so an unauthenticated client can GET /wp-admin/admin-post.php?pwe_preview_template=New_Order&order_id=1 (or admin-ajax.php?action=1 with the same extra args) and receive another customer's billing email, shipping/billing address, line items, and typically the order-received URL that embeds the order key. Order IDs are sequential. The same renderer is also registered as 11 wp_ajax_pwe_get_email_preview_* actions with no capability or nonce, so any Subscriber/customer can IDOR the same data through admin-ajax.php while logged in. Preview does not send mail or persist status; impact is confidentiality of every order.

  includes/order-actions.php:17-27,86-136

  Recommendation

  In pwe_preview_email_page and pwe_ajax_return_html_template, require a logged-in user with current_user_can('edit_shop_order', $order_id) (or manage_woocommerce) and verify a nonce created only on the edit-order screen. Whitelist mail class names instead of concatenating $_GET['pwe_preview_template']. Do not hook the preview renderer to admin_init; use a capability-checked admin-post/AJAX action so admin-ajax.php guests cannot trigger it.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.