PluginProbe
WCPOS – Point of Sale (POS) plugin for WooCommerce / 1.10.18
WCPOS – Point of Sale (POS) plugin for WooCommerce v1.10.18
1.10.18 1.10.17 1.10.16 1.10.15 1.10.13 1.10.14 1.10.12 1.10.11 1.10.10 1.10.9 1.10.8 untagged-3d9b7ccddc54df87c672 1.10.7 1.10.6 1.10.5 1.10.3 1.10.4 1.10.2 1.10.1 1.10.0 1.9.17 1.9.15 1.9.16 1.9.14 1.9.13 All 162 releases
woocommerce-pos / SECURITY.md

SECURITY.md in WCPOS – Point of Sale (POS) plugin for WooCommerce 1.10.18, at SECURITY.md

24 lines 2.1 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 # Security Notes
2
3 ## Open Dependency Advisories
4
5 ### PKSA-y2cr-5h3j-g3ys: firebase/php-jwt
6
7 - Status: open until WCPOS can require PHP 8+ or a PHP 7.4-compatible php-jwt patch is available.
8 - Advisory: https://github.com/advisories/GHSA-2x45-7fc3-mxwq
9 - Last reviewed: 2026-05-07
10 - Affected dependency: `php-scoper/composer.json` currently requires `firebase/php-jwt` as `^6.10.0`.
11 - Upgrade blocker: `php-scoper/composer.json` pins Composer's platform PHP version to `7.4`; the patched `firebase/php-jwt` release line requires PHP 8+.
12 - Current parser paths:
13 - `includes/Services/Auth.php::validate_token()` decodes access and refresh JWTs with local HS256 secrets and validates `iss`, token `type`, user ID, and revocation state.
14 - `includes/API.php::authenticate()` accepts REST API bearer tokens and delegates validation to `Services\Auth::validate_token()`.
15 - `includes/Init.php::determine_current_user_early()` accepts early REST bearer or authorization-parameter tokens and delegates validation to `Services\Auth::validate_token()`.
16 - `includes/Form_Handler.php::pay_action()` accepts checkout cashier tokens from `wcpos_jwt` or legacy `token` query parameters and delegates validation to `Services\Auth::validate_token()`.
17 - `includes/API/Auth.php::refresh_token()` and `includes/API/Auth.php::get_current_jti_from_request()` validate refresh and access tokens through `Services\Auth::validate_token()`.
18 - Required mitigations while pinned:
19 - Continue using local HS256 secrets with explicit `Key` instances; do not use remote key sets or claim-provided key URLs.
20 - Validate issuer claims against the current site URL before trusting a decoded token.
21 - Validate token type, user ID, JTI, refresh JTI, and revocation state before authorizing requests.
22 - Do not add audience, issuer, language-code, key ID, or URL-like JWT claims from user-controlled input without sanitizing and validating them before token generation or downstream use after decode.
23 - Prefer `Authorization: Bearer <token>` headers. Query-parameter tokens are limited to controlled fallback paths and must be sanitized before validation.
24