WP Manifestindependent plugin directory
manifest / ecommerce / zeospay-e

zeosPay-E WP RegistryMedium-severity findings · 1 findingOpen the reportB

by Zeosweb · github.com/zeosweb/zeospay-e · website

★ 0stars
v1.0.20latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/zeosweb/zeospay-e/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/zeosweb/zeospay-e ↗
Plugin de Wordpress para el procesamiento de pagos con ENZONA con integración de WooCommerce. 1. Descompactar el archivo .zip descargado. 2. Subir la carpeta del plugin en el directorio wp-content/plugins/ del sitio con WordPress. 3. Activar zeosPay-E en la página de Plugins. 4. Llenar los datos solicitados para la configuración del plugin en la sección de pagos de WooCommerce. Actualizado el motor de actualizaciones automáticas. Agregado el manejo de errores de la API de enzona. Mejora en el tratamiento con seguridad de los datos que se manejan. Agregado el soporte para las actualizaciones automáticas. Ya funciona!

Releases

3 releases.

Tag
Published
v1.0.20 latest
Jul 11, 2024 2 years ago
v1.0.19
Oct 14, 2023 3 years ago
v1.0.18
Sep 24, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

zeosPay-E 1.0.20 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.20
Findings
1
Worst severity
medium
Content hash
8ce0a68d036d9ffd3225d18c…

Findings

  • medium Obfuscated eval(base64_decode) payment API bootstrap

    enzonaApi.php consists of nested eval(base64_decode(...)) that eventually expands to the Enzona Val payment client. No clear backdoor strings were found after peeling layers, but shipping production payment code exclusively as eval obfuscation is a high-risk pattern (integrity, supply-chain, and hidden-logic risk).

    enzonaApi.php:1-3

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →