Medium-severity findings.

Audited release

1.1.0

Findings

1

Worst severity

medium

Content hash

4b9bc5331af710dfb1c7eef1… Copy

Findings

• medium Purchased-items AJAX missing capability check on order_id

  missing_capability

  wp_ajax_vhc_wc_purchased-items-column_fetch_items_ajax verifies a nonce then loads any order_id and returns line items HTML. There is no current_user_can('edit_shop_order', $order_id) (or similar). A logged-in low-priv user who obtains or reuses a valid nonce, or a CSRF against a shop manager session, can read other customers' purchased items.

  includes/class-vhc-wc-purchased-items-column-admin.php:152-175

  Recommendation

  After verifying the nonce, require current_user_can('edit_shop_order', $order_id) (or manage_woocommerce) before returning order item HTML.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.