USBSwiper Hosted Virtual Terminal WP Registry grade D+. High-severity findings · 4 findingsWP RegistryHigh-severity findings · 4 findingsOpen the reportD+

High-severity findings.

Audited release

4.1.6

Findings

4

Worst severity

high

Content hash

42a35c2fc4d3ca4aaaa6d250… Copy

Findings

• high Unauthenticated update_order_status marks transactions FAILED

  missing_auth

  wp_ajax_nopriv_update_order_status has no nonce or authentication. Any visitor can POST transaction_id and force _payment_status to FAILED (or PENDING for invoices), write _payment_failed_response, and pollute payment logs for arbitrary transaction posts.

  public/class-usb-swiper-public.php:2807-2860

• high vt_delete_product_cb deletes any product without nonce or capability

  missing_capability

  wp_ajax_vt_delete_product (authenticated AJAX only) accepts product_id and calls wp_delete_post with no check_ajax_referer/wp_verify_nonce and no current_user_can. Any logged-in role can delete arbitrary products/posts by ID.

  public/class-usb-swiper-public.php:3060-3080

• high Customer get/delete AJAX lacks ownership and capability checks (IDOR)

  missing_capability

  vt_get_customer_by_id returns full customer records for any customer_id with no merchant_id ownership check (unlike get_customers which scopes by merchant). vt_delete_customer_by_id deletes by id without nonce or ownership verification. Any logged-in user can read or delete other merchants' customer PII.

  public/class-usb-swiper-public.php:4334-4420

• medium Product create/update AJAX checks nonce but not capability

  missing_capability

  vt_create_update_product verifies vt-add-product-form nonce then creates/updates WC_Product_Simple objects with no current_user_can('edit_products') or merchant ownership check on product_id. Any authenticated user who obtains the frontend nonce can add or edit catalog products.

  public/class-usb-swiper-public.php:2932-3010

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.