WeRocket Tools WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+ #10 in Privacy & Compliance

High-severity findings.

Audited release

1.2.30

Findings

2

Worst severity

high

Content hash

a631ba45d5b563ed6587ca8d… Copy

Findings

• high Guest withdrawal session is predictable, leaking order PII and allowing a second visitor to file the request

  predictable_token

  Unauthenticated visitors who open the [wr_retractation] form (or the My Account endpoint while logged out) get a logged-out nonce and can look up a WooCommerce order by numeric id plus billing email. On success the plugin stores {order_id, email} for 30 minutes in a site-wide transient whose key is wr_lookup_g_ plus the first 16 hex chars of md5(REMOTE_ADDR + '|' + User-Agent). Anyone else with that same pair — another guest on the same NAT or CGNAT with the same browser string, or every guest if a reverse proxy leaves REMOTE_ADDR as the proxy IP — loads step 2 and is shown the order number, billing first and last name, full billing address, and line-item names and quantities. Step 2 never re-checks the billing email; it trusts the transient, so the second visitor can submit the withdrawal. That inserts a row, adds an order note, sets _wr_retractation_id, and emails the customer and the merchant. A logged-in user is keyed by user id and is not affected.

  includes/Modules/Retractation/Frontend.php:349-358

  Recommendation

  Set an unguessable HttpOnly cookie (random_bytes) when step 1 succeeds and key the transient on that value, not on IP or User-Agent. On step 2 and on render, re-run validate_order() against the stored email before showing PII or inserting the request.

• medium Shared Google Places API key is hardcoded and restored when the setting is cleared

  hardcoded_credentials

  Every install defaults google_api_key to the agency key AIzaSyAdbeN4FGLGh4DsP63i5DYyQCsSVQ8Zjsw, and sanitize_settings() writes that same key back if an administrator saves an empty value. request_place_details() sends it as the key query parameter to https://maps.googleapis.com/maps/api/place/details/json. The public GET /wp-json/werocket/v1/reviews handler strips the key from the JSON response, so visitors do not receive it from the REST API, but the constant is in the distributed plugin and is used server-side on cache miss (including that public route and the weekly cron). Anyone with the release can spend the vendor project's Places quota or billing, which the plugin itself tells administrators surfaces as OVER_QUERY_LIMIT and breaks review sync on every site still on the default key.

  includes/Modules/GoogleReviews/GoogleReviewsModule.php:57-64

  Recommendation

  Remove the embedded key, rotate it in Google Cloud, and require each site to enter its own API-restricted key. Treat an empty save as "no key" instead of falling back to a shared secret.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.