RS WooCommerce Order Messages WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.2.1

Findings

1

Worst severity

high

Content hash

d6bd661e6ab994c9855fd7be… Copy

Findings

• high ACF order-messages options page is writable with edit_posts and echoed unescaped on thank-you pages and emails

  xss_stored

  acf_add_options_sub_page() for slug wom-order-messages omits 'capability'. ACF Pro validate_page() therefore defaults capability to edit_posts and registers add_submenu_page('woocommerce', ..., 'edit_posts', 'wom-order-messages'). WordPress user_can_access_admin_page() allows any user with edit_posts to load and POST that screen (ACF nonce only; no manage_woocommerce). That includes editor, author, and contributor — not only shop_manager/admin. Saved repeater content is later printed with echo do_shortcode($msg['content']) and no escaping on woocommerce_order_details_* (order-received / My Account view-order) and woocommerce_email_* hooks. On a single-site install the editor role has unfiltered_html, ACF skips wp_kses_post_deep, and a <script> or payment-skimmer snippet in the WYSIWYG runs for every customer who views a matching receipt or email. Author/contributor are kses-filtered on save but can still inject links and images into those transactional surfaces. Shop managers (intended operators) lack unfiltered_html, so this is inverted privilege versus editor. Per-product ACF location (post_type product) is gated by edit_products and is not this issue.

  rs-woocommerce-order-messages.php:35-42

  Recommendation

  Pass 'capability' => 'manage_woocommerce' (or manage_options) into acf_add_options_sub_page so only shop managers and administrators can edit global messages. Keep product-level fields on edit_products. On output, run the message through wp_kses_post() before do_shortcode() unless the stored author had unfiltered_html, and do not execute arbitrary shortcodes from untrusted roles.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.