R2 Sunpay Invoice WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Medium-severity findings.

Audited release

1.0.14

Findings

1

Worst severity

medium

Content hash

e4fc46fdeb79f0e34c3f4c2f… Copy

Findings

• medium Invoice AJAX missing capability checks (nonce-only)

  missing_capability

  generate_invoice, invalid_invoice, allowance_invoice, invalid_allowance, get_invoice_list, and get_orders_list only call check_ajax_referer. Any authenticated user who receives the localized nonce (shop_order admin screen / invoice list) can issue or void invoices for arbitrary order IDs without an explicit manage_woocommerce/manage_options check.

  inc/classes/Ajax/Ajax.php:47-70

  Recommendation

  After nonce verification, require current_user_can('manage_woocommerce') (or edit_shop_orders) and verify the user may manage that order.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.