WPLoyalty - Judge.Me WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.1

Findings

1

Worst severity

high

Content hash

1df3db8a675e00feaa5f9d2f… Copy

Findings

• high Public review webhooks accept HMAC with an empty Judge.me shop token and award loyalty points

  auth_bypass

  registerRestApi() exposes POST /wp-json/wployalty/judgeme/v1/review/created and /review/updated with permission_callback __return_true. handleCreatedAction and handleUpdatedAction authenticate only by hash_equals($header, hash_hmac('sha256', $data->get_body(), get_option('judgeme_shop_token'))). There is no empty/false-token reject, no is_string() check on the JUDGEME-HMAC-SHA256 header, and no review-id replay guard. PHP coerces a missing option (false) to HMAC key ''; an unauthenticated client can therefore compute the expected hex digest, POST any reviewer.email (FILTER_VALIDATE_EMAIL) and product_external_id > 0, and reach applyEarnProductReview. The add-on loads whenever the Judge.me plugin is listed as active (isJudgeMeActive), not when a shop token exists; the official Judge.me plugin itself skips widgets when the token is empty, but these WPLoyalty routes still register. Those points are WPLoyalty store credit. A non-empty private shop token is a real gate; the defect is fail-open when that secret is missing.

  App/Controllers/Controller.php:290-378

  Recommendation

  If judgeme_shop_token is empty or not a string, or if JUDGEME-HMAC-SHA256 is missing/not a string, return 401 and do not award points (do not call hash_equals/hash_hmac with a non-string). Optionally skip register_rest_route until a non-empty token exists. Return 401 on HMAC mismatch instead of 200. Record the Judge.me review id and refuse duplicate awards for the same email+product+review.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.