Critical findings.

Audited release

0.0.13

Findings

4

Worst severity

critical

Content hash

225224e56fde96df54884ba0… Copy

Findings

• critical Unauthenticated create_contract mass-assigns POST into wp_insert_post and can mark any WooCommerce order signed

  missing_auth

  wp_ajax_nopriv_create_contract is reachable by guests. The only gate is check_ajax_referer('power-contract','nonce'); that nonce is localized as signature_pad_custom_data.env.nonce on every public contract_template (CPT is public and publicly_queryable; uid-0 nonces work). After skipping sanitization of screenshot/signature, the handler runs WP::separator($post_data, 'post'), which copies any key in the post data-field list (ID, post_author, post_content, post_title, post_status, post_type, post_name, tax_input, …) into $data and everything else into $meta_data. $data is wp_parse_args'd on top of the intended contract defaults, so attacker keys win, then wp_insert_post($args) is called with $data['meta_input']=$meta_data. wp_insert_post does not check capabilities: a guest can create a published page/post/product, or pass ID of an existing post (homepage, product, order post) and overwrite it, including WooCommerce price meta (_price, _regular_price). Passing post_status=approved bypasses merchant review. If _order_id is set, get_redirect_url() loads that order with no ownership check and writes is_signed=yes, which Checkout::redirect_before_thankyou_base_condition treats as 'contract already signed'. Pre-checkout can also be skipped with ?is_signed=yes. Observable on a site with at least one published template: POST admin-ajax.php action=create_contract with a scraped nonce, a tiny PNG data-URI screenshot, contract_template_id, and ID/post_type/post_status/_order_id as desired.

  inc/classes/Resources/Contract/Ajax.php:27-142

  Recommendation

  Do not pass raw POST through WP::separator into wp_insert_post. Allow-list contract meta keys, force post_type=contract and post_status=pending, and reject any ID/post_author/post_type/post_status supplied by the client. Require a valid published contract_template_id. When setting is_signed, verify the current user owns the order (or the order key) and that a real signature exists. Do not treat a GET is_signed flag as proof of signing.

• high Stored XSS in the contract review metabox and notification email via unsanitized signature/meta

  xss_stored

  create_contract stores every leftover POST field as contract post meta. 'signature' (and 'screenshot' before upload) is in the sanitize skip list, so HTML is stored raw. Init::render_meta_box dumps every meta key and value into an admin table with no escaping. Values starting with data:image are concatenated into <img src> / <a href> without esc_url/esc_attr, so a payload such as data:image/png" onerror="alert(document.cookie) executes when a merchant opens the contract. Values that do not start with data:image (e.g. signature=<img src=x onerror=...>) are printed as HTML. Email::send_email captures that same metabox HTML and wp_mails it to power_contract_settings emails. Reviewing submitted contracts is the plugin's primary admin workflow, so the XSS is reliably triggered. Meta keys are also unescaped, so an HTML-bearing POST key becomes a table cell.

  inc/classes/Resources/Contract/Init.php:177-209

  Recommendation

  Escape meta keys with esc_html and values with esc_html, or wp_kses_post if HTML is required. Put data URIs only through esc_url and never into unquoted attributes. Do not skip sanitization of signature; store it as an uploaded attachment URL. Sanitize POST keys before using them as meta keys.

• high Any logged-in user can approve or reject contracts with no capability check or nonce

  missing_capability

  admin_post_approve_contract and admin_post_reject_contract are registered without a nopriv twin (so guests are excluded) but the handlers never call current_user_can or wp_verify_nonce. They take post_id from GET, confirm post_type=contract, and wp_update_post the status to approved or rejected. The metabox renders these as bare GET links (admin-post.php?action=approve_contract&post_id=N) with a 'disabled' CSS class only — not an actual access control. A Subscriber or Customer who visits that URL, or an attacker who CSRF's any logged-in user, can approve a fraudulent contract or reject a legitimate one. LifeCycle then fires power_contract_contract_approved / power_contract_contract_rejected. Combined with finding 1, a guest can create a pending contract attached to a victim order and a subscriber account can immediately approve it.

  inc/classes/Resources/Contract/Init.php:217-288

  Recommendation

  Require current_user_can('edit_post', $post_id) (or a dedicated approve_contracts cap) and a nonce on both handlers. Switch the metabox from GET links to POST forms with wp_nonce_field. Treat the CSS 'disabled' class as UI only.

• high Unauthenticated order PII disclosure via order_id on public contract templates

  information_disclosure

  When WooCommerce setting display_order_info is enabled, Shortcodes::set_default_value reads $_GET['order_id'] with no ownership, capability, or key check, loads that order, and writes billing full name, shipping address, billing_phone, and order total into public [pct_input] value attributes. The author left a TODO acknowledging this ('防止被猜出其他用戶個資') but the guard is commented out. After-checkout redirect already puts order_id in the contract URL (Checkout::redirect_before_thankyou), and order IDs are sequential. Anyone who can open the public contract_template can enumerate order_id and read other customers' checkout PII in the HTML. Base::get_full_address also falls back to the same unauthenticated order_id GET.

  inc/classes/Shortcodes/Shortcodes.php:319-361

  Recommendation

  Restore the ownership check (current user must own the order). For guests, require the WooCommerce order key (or a signed token) in addition to order_id. Do not auto-fill PII on a publicly cacheable template URL that only contains a sequential id.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.