High-severity findings.

Audited release

6.0.4

Findings

4

Worst severity

high

Content hash

1d410c5d18c6b1a96ac01cc7… Copy

Findings

• high Unauthenticated CAPI conversion injection via public /custom-event REST route

  missing_permission_callback

  POST /wp-json/ratul-ads-conversion-tracker/v1/custom-event is registered with permission_callback __return_true. The handler accepts allowlisted event names that include Purchase, InitiateCheckout, Lead, Donate, and StartTrial, merges attacker-controlled params (including value/currency) into custom_data, and immediately calls Ratul_ACT_Meta::send / Ratul_ACT_TikTok::send when those platforms are enabled. Default consent_mode is 'none', so Ratul_ACT_Consent::is_granted() returns true even on REST requests. The only control is a 10-token rate limiter keyed on md5(client_ip + hashed User-Agent). get_request_ip() prefers HTTP_CF_CONNECTING_IP then HTTP_X_REAL_IP then the last X-Forwarded-For token — all client-controlled on a default WordPress host that is not behind Cloudflare/nginx stripping those headers. Independently, rotating User-Agent mints a new bucket, so the limiter does not bound an attacker. Observable consequence: fake Purchase events with arbitrary value appear in the merchant's Meta/TikTok Events Manager and in option ratul_act_debug_log, using the stored ratul_act_meta_access_token / ratul_act_tiktok_access_token, which can poison attribution and cause conversion-optimized campaigns to spend against fraudulent conversions. Sibling public route POST /pixel/{platform} is the same class of CAPI proxy (no event-name allowlist) but currently fatals because it calls private Ratul_ACT_Frontend::get_request_ip().

  frontend/class-ratul-act-frontend.php:150-254

  Recommendation

  Do not accept Purchase/Lead/Donate (or any value-bearing conversion) from an unauthenticated browser bridge. Require a real WooCommerce/EDD session proof or a per-event server-issued nonce bound to cart/order state. Rate-limit exclusively on the TCP peer (REMOTE_ADDR) unless the site operator has explicitly configured a trusted proxy, and do not include User-Agent in the bucket key. Keep platform send() behind that gate so stored CAPI tokens cannot be used as an open conversion API.

• high Unauthenticated WooCommerce order data disclosure on order-received page

  information_disclosure

  enqueue_pixel_script() runs on every frontend request. When is_order_received_page() is true it reads get_query_var('order-received') as an order ID, loads the order with wc_get_order(), and localizes value, currency, order_id, contents (SKU, quantity, item_price), content_ids, event_id, and gclid into the public ratul_act_config JavaScript object. WooCommerce's is_order_received_page() is true whenever the checkout order-received endpoint is in the query vars; it does not verify $_GET['key'] against the order key (that check happens later in the thankyou template, after scripts are enqueued). Sequential order IDs can therefore be enumerated at /checkout/order-received/{id}/ without the wc_order key. Observable consequence: any visitor can read another customer's purchase total, line items, and stored Google click ID from page source / ratul_act_config, even when WooCommerce itself renders the invalid-order screen. This path does not require advertising platforms to be enabled (ratul_act_enabled defaults to 1).

  frontend/class-ratul-act-frontend.php:449-492

  Recommendation

  Before localizing any order fields, require a matching order key (hash_equals($order->get_order_key(), wc_clean(wp_unslash($_GET['key'] ?? '')))) and the same visibility rules WooCommerce uses for the thank-you page (logged-in owner or valid guest key). Do not enqueue purchase payloads for invalid or other users' orders.

• medium Hardcoded CRXSM license-server client credentials

  hardcoded_credentials

  Ratul_ACT_License::get_client() embeds a client_id, HMAC client_secret, and Ed25519 public_key used to sign activate/deactivate/heartbeat requests to https://great10.xyz/Tunnel/index.php. Anyone with the plugin package can impersonate this software to the license tunnel (forge signed API calls for arbitrary domains). These secrets do not grant WordPress admin on customer sites, and is_active() only drives the License settings UI rather than gating CAPI sends. They are still long-lived credentials shipped in every install.

  includes/class-ratul-act-license.php:23-29

  Recommendation

  Treat the license HMAC secret as a server-side credential that must not ship in publicly distributed plugin copies, or accept that the tunnel cannot authenticate the client at all and rely only on the offline Ed25519 license signature. Rotate the exposed client_secret on the license server.

• medium Unauthenticated REST endpoints set first-party attribution cookies

  cookie_injection

  POST /wp-json/ratul-ads-conversion-tracker/v1/capture-clickids (permission_callback __return_true, no nonce) reads JSON ids.fbclid/ttclid/gclid/msclkid/ScCid and calls setcookie() for _fbc, _ttclid, _gcl_aw, msclkid, and _sccid (90-day, path=/, httponly=false). WordPress REST reflects arbitrary Origin with Access-Control-Allow-Credentials: true, so a third-party page can credentialed-POST and toss those cookies onto a shop visitor. That lets an attacker bind the victim's subsequent Purchase CAPI events to the attacker's click IDs (attribution theft). Related public POST /capture writes the same identifiers into user meta for logged-in users and into a transient keyed by attacker-supplied session_id, and /capture-pii writes a hashed email into the WooCommerce session.

  frontend/class-ratul-act-frontend.php:102-130

  Recommendation

  Do not set first-party cookies from a CORS-open REST body. Capture click IDs only from same-request URL parameters in PHP (CookieHelper already does this) or require a same-origin nonce that is not sent to other origins. Reject cross-origin credentialed calls (do not rely on core REST CORS).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.