High-severity findings.

Audited release

3.1.1

Findings

3

Worst severity

high

Content hash

b817c3c418f4a469dfee5dac… Copy

Findings

• high Debug logger writes API keys, card tokens, and IPN bodies to a web-accessible plugin file

  information_disclosure

  When the gateway debug checkbox is enabled (woocommerce_upayments_settings[debug]), WC_Upayments::log() appends print_r($content) to UP_PLUGIN_PATH . 'debug.log' (wp-content/plugins/woocommerce-upayments/debug.log). There is no .htaccess deny rule. process_payment and Scheduler::process explicitly log the string 'API key:' followed by $this->apiKey, the full charge JSON (customer name/email/mobile, saved-card tokens, amounts), curl responses, and web_hook_handler logs raw $_REQUEST. An empty debug.log is shipped in the plugin, so the URL is predictable. Any unauthenticated visitor who can fetch that path obtains the live Bearer token used against apiv2api.upayments.com, enough to create charges, retrieve customer cards, and auto-deduct. Debug is a supported production troubleshooting toggle, not a developer-only constant.

  UPayments.php:1034-1051

  Recommendation

  Never write secrets to a file under the plugin directory. Use wc_get_logger() with a private uploads log (as WooCommerce does), redact apiKey and card tokens, and deny HTTP access to *.log. Rotate any API key that may have been logged. Delete shipped debug.log from the distribution.

• medium Subscription pause/resume is a CSRF-able GET with no nonce

  csrf

  An init callback reads $_GET['upay_action'] and $_GET['order_id'] on every front-end request. After confirming the requester is logged in as the order owner, unsubscribe verifies wp_verify_nonce(..., 'upay_unsubscribe_{id}'), but pause and resume do not. The handler then writes _upay_subscription_status to paused or active, $order->save(), and redirects. The my-account view-order template already generates nonce URLs for pause/resume (upay_pause_{id} / upay_resume_{id}) that this handler never checks. Observable: a logged-in subscriber who visits an attacker page with <img src="https://shop/?upay_action=pause&order_id=123"> has auto-deduct stopped; upay_action=resume re-enables Scheduler::process charging on the next hourly cron. Order IDs are sequential and often visible in emails/account URLs. Unauthenticated users are blocked by is_user_logged_in().

  UPayments.php:2433-2480

  Recommendation

  Verify a unique nonce for every upay_action (the templates already create upay_pause_{id} and upay_resume_{id}). Prefer POST. Restrict to subscription orders and send users through wp_safe_redirect after a failed nonce without calling $order->save().

• medium Payment API curl disables TLS certificate verification

  insecure_config

  process_payment (charge create) and getSavedCards set CURLOPT_SSL_VERIFYPEER to false while sending Authorization: Bearer $this->apiKey and receiving a redirect URL that checkout follows. A network attacker who can MITM the shop server’s outbound HTTPS can steal the merchant API key and replace result.data.link / transactionData.redirect_url with a phishing/skimmer page; process_payment then returns that URL as the WooCommerce checkout redirect. getSavedCards similarly exposes stored card tokens in the forged response path used on the checkout form. Scheduler’s auto-deduct curl leaves SSL verification at the default (commented-out disable), so only the customer-facing charge and card-retrieve calls are affected.

  UPayments.php:1040-1052

  Recommendation

  Remove CURLOPT_SSL_VERIFYPEER false (and do not set CURLOPT_SSL_VERIFYHOST to 0). Use WordPress HTTP API (wp_remote_post) which verifies TLS by default. Fail closed if the certificate is invalid.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.