Critical findings.

Audited release

1.1

Findings

1

Worst severity

critical

Content hash

b2efd755640700bde5f3f709… Copy

Findings

• critical Unauthenticated webhook spoof grants paid membership; clientAccnum is not a secret

  auth_bypass

  admin-ajax.php?action=ccbill-webhook is registered for both wp_ajax_ and wp_ajax_nopriv_ with no capability, nonce, signature, or source-IP check. The only gate (webhook.php:22-33) is that request clientAccnum equals option pmpro_ccbill_account_number. That value is a public 6-digit CCBill merchant ID: sendToCCBill() puts it on the FlexForms redirect as clientAccnum together with pmpro_orderid (the pending MemberOrder id). Any visitor who starts CCBill checkout can read both from the Location URL, skip payment, and POST eventType=NewSaleSuccess&clientAccnum=…&X-pmpro_orderid=…. NewSaleSuccess loads that order, saveOrder(), and pmpro_ccbill_ChangeMembershipLevel() → pmpro_complete_async_checkout(), granting the level stored on the order. Cancellation/Expiration cancel a subscription by id; RenewalSuccess/Failure insert orders and send invoice or billing-failure emails. CCBill documents the intended authenticators this plugin ignores: webhook source IPs (64.38.212/215/240/241.0/24) and, because this integration uses Dynamic Pricing, dynamicPricingValidationDigest = md5(subscriptionId + '1' + salt). The salt is already stored as pmpro_ccbill_salt and used only for outbound formDigest. v0.4's CVE-2023-40608 fix added the account-number compare; v1.1 still documents in-tree that a postback can be spoofed with a guessed order ID and only stopped trusting X-pmpro_levelid for the granted level.

  webhook.php:22-72

  Recommendation

  Do not treat clientAccnum as a webhook secret. Before NewSaleSuccess calls saveOrder()/pmpro_complete_async_checkout, require a matching dynamicPricingValidationDigest (md5(subscriptionId + '1' + pmpro_ccbill_salt) for approvals; denied uses '0') and/or confirm the subscription/transaction via the Datalink API the plugin already calls for cancel/sync. Reject requests whose REMOTE_ADDR (or validated forwarding header from a known proxy) is outside CCBill's published webhook ranges. Put an unguessable token in the configured webhook URL and verify it. Refuse to complete orders that are not in token/pending status for gateway ccbill. Apply equivalent checks on Cancellation/Expiration/Renewal handlers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.