R2 WC Product Notify WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.30

Findings

2

Worst severity

high

Content hash

b2a862344a17b1f9207c4399… Copy

Findings

• high Preview mail AJAX missing capability (and registered for nopriv)

  missing_capability

  send_preview_mail is hooked to both wp_ajax_ and wp_ajax_nopriv_. The callback only calls check_ajax_referer('r2_wc_ajax_nonce') then builds and cron-schedules an email to the operator. No current_user_can check. The nonce is localized on every admin page via admin_enqueue_scripts without a capability/screen restriction, so low-privilege users who can access wp-admin obtain a valid nonce and can trigger operator notification emails.

  inc/admin/class-ajax.php:21-169

  Recommendation

  Require manage_woocommerce or edit_products; remove nopriv registration; only enqueue/localize the nonce on product edit screens for authorized roles.

• low AJAX error/success responses echo raw $_POST

  information_disclosure

  JSON responses include the full $_POST array under data, which can leak request parameters in logs/proxies and aid further attacks.

  inc/admin/class-ajax.php:59-66

  Recommendation

  Do not return raw $_POST in JSON responses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.