ERP Sync Products and Coupons WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.4.19

Findings

1

Worst severity

high

Content hash

fa0d13f2fa27878be9b4b479… Copy

Findings

• high Webhook trigger-sync admits unauthenticated callers when secret unset

  auth_bypass

  verify_webhook_secret returns true if erp_sync_webhook_secret is empty. Default installs expose POST /wp-json/erp-sync/v1/trigger-sync which runs Sync_Service::import_new_only(), letting strangers mutate products/coupons.

  includes/class-erpsync-webhook.php:65-70

  Recommendation

  Deny by default when secret is empty; require a non-empty shared secret or Application Password.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.