Medium-severity findings.

Audited release

1.0

Findings

1

Worst severity

medium

Content hash

fa5d1350fb385936dab780ca… Copy

Findings

• medium Logged-in users can add notes to arbitrary orders without ownership or nonce checks

  missing_auth

  wcs_cancel_confirmation is hooked only to wp_ajax_wcs_cancel_confirmation (any authenticated user; no nopriv). The function never calls current_user_can, never compares the order's customer id to get_current_user_id(), never verifies the id is a subscription the requester can view, and never calls check_ajax_referer/wp_verify_nonce. It loads whatever wc_get_order(intval($_POST['subscription_id'])) returns — shop_order, shop_subscription, or refund — concatenates a 'Cancellation Reason:' header with sanitize_text_field($_POST['reason_to_cancel']), add_order_note()'s it (private note; is_customer_note defaults to 0), save()'s, and echoes the new comment id. The My Account JS is not a control: the action is registered even when wcs-cancel-confirmation is 'no', and an attacker POSTs admin-ajax.php directly. Blast radius is integrity of the merchant-facing order-note audit trail (IDOR plus CSRF of any logged-in session), not storefront XSS, payment-gateway tamper, or unauthenticated writes. If the id is not an order, wc_get_order() is false and add_order_note() fatals that request.

  wcs-cancel-subscription-confirmation.php:76-91

  Recommendation

  Before add_order_note: check_ajax_referer on a nonce localized only on My Account; load the object with wcs_get_subscription(); return if it is not a subscription; require that the current user owns it (get_user_id() === get_current_user_id()) or current_user_can('edit_shop_order', $id). Do not register the AJAX action when the reason prompt is disabled. Guard against a non-object wc_get_order() result.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.