High-severity findings.

Audited release

1.1.2

Findings

4

Worst severity

high

Content hash

7c6b8cc12a833ee5764fd03b… Copy

Findings

• high Reminder cron puts every customer email in the To: header

  information_disclosure

  woomr_job() (hooked to woomr_cron) loads all users with role customer, and for each active reminder appends every matching customer's user_email onto a single $list, then calls wp_mail($list, $subject, $content, $headers). WordPress/PHPMailer treats an address array as multiple To: recipients, so every customer can see every other matching customer's email address in the message headers. $list is initialized once and never reset between reminders, so later reminders accumulate prior recipients. The intended days-after filter compares a DateInterval object to rwmb_meta() (post meta string, e.g. '7'); on PHP 8 that object>=string comparison is true, so the date gate does not actually restrict who is included. WP-Cron can be triggered by any site hit / wp-cron.php. Observable consequence: a customer who placed any completed order receives a store-From email whose To: line enumerates other customers' addresses (PII).

  admin/class-woo-mail-reminder-admin.php:726-794

  Recommendation

  Send one message per customer (or put other recipients in Bcc). Compare (int) $diff->days to (int) $days_after. Reset the recipient list inside the reminder loop. Do not put other customers' addresses in To/Cc.

• high Email preview on init is nonce-only and echoes unsanitized request HTML

  xss_reflected

  woomr_preview_emails is hooked to init (front-end and admin). If preview_woomr_mail is present it only wp_verify_nonce($_REQUEST['_wpnonce'], 'woomr-preview') — no current_user_can, no is_admin, no edit_post check. It then do_shortcode(stripslashes($_REQUEST['content'])), takes stripslashes($_REQUEST['heading']), wraps them with WC_Email::style_inline(mailer->wrap_message()), and echo $output; exit. WooCommerce wrap_message / email-header prints the heading in an unescaped <h1> and the body via wpautop/wptexturize with no kses, so <script> and event-handler markup in content or heading execute as a full HTML document (not innerHTML). The nonce is a hidden Meta Box field on the woomr_reminder edit screen (edit_pages). Editor is below manage_options and can submit arbitrary HTML/shortcodes; a stolen nonce in the GET URL also works for that user. Shortcode execution runs as the current user.

  admin/class-woo-mail-reminder-admin.php:668-694

  Recommendation

  Require current_user_can('edit_post', $post_id) (or manage_woocommerce) in addition to the nonce. Load heading/body from the reminder post, not from $_REQUEST, or run them through wp_kses_post. Do not do_shortcode on raw request input. Escape the heading on output.

• medium Any logged-in user can send mail via woomr_test_mail

  missing_capability

  wp_ajax_woomr_test_mail (no nopriv, but any authenticated role including WooCommerce Customer/Subscriber) reads $_POST['mail'] with no sanitize_email, no check_ajax_referer, and no current_user_can, then wp_mail()s a store-From test message to that address. The JS in woo-mail-reminder-admin.js posts {action: woomr_test_mail, mail} with no nonce field. A customer account or a CSRF form on a logged-in session is enough to use the site as a limited mail relay (fixed subject/body, arbitrary To). On older WP/PHPMailer, unsanitized To can also be used for header injection.

  admin/class-woo-mail-reminder-admin.php:511-537

  Recommendation

  Gate with current_user_can('manage_options') (or manage_woocommerce) and check_ajax_referer. Pass sanitize_email() and abort if empty. Use wp_send_json_*.

• medium Any logged-in user can set reminder status post meta

  missing_capability

  wp_ajax_woomr_deactivate_reminder has no nonce and no capability check. It takes $_POST['reminder_id'] and always update_post_meta($reminder_id, 'status', 1) (both branches write 1; no post-type check, so any post ID's 'status' meta can be set). A Subscriber/Customer can enumerate public woomr_reminder IDs (CPT publicly_queryable) and activate reminders, causing the next woomr_cron run to mass-email customers. A second path, woomr_set_status_reminder on load-edit.php, updates status from $_REQUEST['set_status'] after wp_verify_nonce('reminder-status-action') only — load-edit.php fires in admin.php before edit.php's edit_pages wp_die, so the sole gate is the nonce, not a capability.

  admin/class-woo-mail-reminder-admin.php:548-572

  Recommendation

  Require current_user_can('edit_post', $reminder_id), verify the post type is woomr_reminder, and check_ajax_referer. Apply the same cap check in woomr_set_status_reminder. Toggle status instead of always writing 1.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.