WPLoyalty - Yuko Review WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

1.0.3

Findings

1

Worst severity

high

Content hash

61a520d87d2fae4f3d181c14… Copy

Findings

• high Public Yuko webhook HMAC fails open on empty secret and awards loyalty points

  auth_bypass

  register_rest_route('wployalty/yuko/v1','/review/approved') uses permission_callback __return_true and is registered on every rest_api_init regardless of configuration. verifySignature reads get_option('wplyr_settings')['secret_key'] ?? '' and, as long as header x-yuko-hmac-sha256 is non-empty, computes base64(HMAC-SHA256(json_encode(json_decode(raw body), JSON_UNESCAPED_SLASHES), secret)). It never rejects an empty/missing secret. HMAC with key '' is public and deterministic: an unauthenticated caller POSTs JSON {email, platform_product_id, status:'approved'} and the matching digest (e.g. payload {"email":"attacker@example.com","platform_product_id":123,"status":"approved"} → xsClb61+/EFCu3ux/2OaXZbdXVQG/1OREVgNbDBWWWM=). hash_equals succeeds, then handleApprovedReview passes the attacker email and product id to ProductReview::applyEarnProductReview with no purchase check and no processed-review-id store. Default after activate is no option, so this is live until a shop manager saves a secret. Observable: POST /wp-json/wployalty/yuko/v1/review/approved with that header credits WPLoyalty review-campaign points for the given email, redeemable as store credit. The same handler also lacks replay/idempotency of its own (no timestamp in the MAC, no review id recorded), so uniqueness depends entirely on the parent helper.

  App/Controllers/Common.php:119-216

  Recommendation

  Refuse verification when secret_key is missing or empty (fail closed; do not HMAC with ''). Sign/verify the raw request body, not a re-encoded JSON document. Require a minimum secret length, bind a timestamp or Yuko review id into the MAC, persist processed review ids for idempotency, and return 401 on HMAC failure. Keep permission_callback __return_true only after the callback rejects unsigned requests.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.