WooCommerce and UpdatePulse Server integration WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

High-severity findings.

Audited release

2.0.1

Findings

2

Worst severity

high

Content hash

c14cd846a34886fcf574fe75… Copy

Findings

• high License package download trusts GET package_slug and does not bind license to user

  file_access

  download_package() requires the logged-in user to match uid but then loads a license only by lic_id (no ownership/email check) and calls upserv_download_local_package() with the attacker-controlled GET package_slug rather than $lic->package_slug. Observable consequence: any logged-in customer with knowledge of any unexpired license id can download arbitrary UpdatePulse packages by swapping package_slug (or using another customer's lic_id).

  includes/LicOrder.php:476-511

  Recommendation

  Authorize against the license record: verify the license belongs to the current user (email/user id), require order_id match, and download only $lic->package_slug (ignore client-supplied slug). Prefer capability-checked/signed download tokens.

• high License package download trusts GET package_slug and does not bind license to user

  file_access

  download_package() requires the logged-in user to match uid but then loads a license only by lic_id (no ownership/email/order binding) and calls upserv_download_local_package() with attacker-controlled GET package_slug rather than $lic->package_slug. order_id is read and never checked. Observable consequence: any logged-in customer who knows (or guesses) any unexpired license id can download arbitrary UpdatePulse packages by swapping package_slug, or use another customer's lic_id.

  includes/LicOrder.php:476-511

  Recommendation

  Authorize against the license record: verify the license belongs to the current user (email/user id), require order_id match, and download only $lic->package_slug (ignore client-supplied slug). Prefer capability-checked or signed download tokens.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.