WP Manifestindependent plugin directory
manifest / ecommerce / return-to-shop

Return to shop WP RegistryMedium-severity findings · 1 findingOpen the reportB

Wordpress plugin to change woocommerce *Return To Shop* url. WPML Supported!

by Smit Patel · github.com/smitpatelx/return-to-shop · website

★ 2stars
1.0.1latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/smitpatelx/return-to-shop/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/smitpatelx/return-to-shop ↗
Return To Shop + Wordpress 5.5 Tested ☑️ + WPML support ☑️ + WooCommerce ☑️ Required Plugin - WooCommerce Modification & Contribution - Feel free to change, modify & distribute under GPL V2 - Dont push directly to master branch - Do not change author's name Smit Patel - Add your own name after modification as follow:

Releases

2 releases.

Tag
Published
1.0.1 latest
Sep 2, 2020 6 years ago
v1.0
Aug 17, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Return to shop 1.0.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.1
Findings
1
Worst severity
medium
Content hash
95214e4b8583192d311fbca3…

Findings

  • medium Settings save lacks nonce (admin CSRF)

    csrf

    rts_page_callback is only reachable via a manage_options submenu, but the POST handler updates rts_page_id and rts_wpml_support with no wp_nonce_field/check_admin_referer. A CSRF from a logged-in admin's browser can redirect the WooCommerce 'Return to shop' URL to an attacker-chosen page_id.

    return-to-shop.php:60-72

    Recommendation

    Add wp_nonce_field + check_admin_referer; sanitize page_id with absint; keep manage_options check in the handler.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →