Medium-severity findings.

Audited release

1.5.0

Findings

1

Worst severity

medium

Content hash

a50506fc9649a6a9b0526629… Copy

Findings

• medium Payment callback processes orders despite token mismatch

  unsafe_input

  payline_callback (woocommerce_api_wc_gateway_payline) loads payment details by token from Payline. If the token does not equal order meta _payline_token it only adds a note ('updating order anyway') and still calls payment_complete / status updates. Weakens binding between Payline session and WooCommerce order.

  class-wc-gateway-payline.php:905-970

  Recommendation

  Abort processing when token !== stored _payline_token; do not mark paid on mismatch.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.