Low-severity findings only.

Audited release

1.15.3

Findings

1

Worst severity

low

Content hash

7bd3c8c2e3c81028a0980006… Copy

Findings

• low Path traversal in document upload sub-directory

  file_access

  Xcore_Documents::setCustomUploadPath() canonicalises custom_upload_base_dir with realpath(), but custom_upload_sub_dir is only ltrim()'d of leading slashes and appended. The containment check is a string prefix check on the un-normalised path, so a value like '../../../plugins/foo' passes and wp_upload_bits() writes the decoded document outside wp-content/uploads (any allowed MIME type). Requires upload_files + edit_shop_order (shop manager/administrator via the Xcore API).

  includes/class-xcore-documents.php:249-262

  Recommendation

  Reject '..' segments in custom_upload_sub_dir (or sanitize each segment with sanitize_file_name) and compare realpath()/wp_normalize_path() of the final directory against the uploads base.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.