Infipay Woocommerce Multi Payment WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

High-severity findings.

Audited release

1.1.4

Findings

3

Worst severity

high

Content hash

fbdf656ea1f19acc725f71ff… Copy

Findings

• high Hardcoded PayPal sandbox API credentials in test2.php

  hardcoded_credentials

  includes/paypal-checkout/test2.php is a standalone runnable script containing hardcoded PayPal NVP user, password, and signature for api-3t.sandbox.paypal.com. Directly reachable; demonstrates leftover developer tooling in the distributed plugin.

  includes/paypal-checkout/test2.php:1-14

• medium Open redirect via pay.php redirect_url parameter

  unsafe_input

  includes/paypal-checkout/pay.php takes $_GET['redirect_url'], urldecodes it, and issues Location header with no allowlist — unauthenticated open redirect useful for phishing off the merchant domain.

  includes/paypal-checkout/pay.php:1-6

• medium Dev/test payment scripts left in production package

  dev_tool_in_production

  Multiple standalone scripts (test.php, test2.php, test3.php, check-balance.php, etc.) enable display_errors and lack WordPress bootstrap/auth. They form unnecessary attack surface alongside the refund proxies.

  includes/paypal-checkout/test2.php:1-20

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.