Security review of the plugin (family-wide request). Four fixes, each with a smoke assertion and a planted-fault control that turned it red:
Discount follows the billing email (order address); the tracked session email used to win, so a guest could post a discounted address and check out under their own.
Shipping packages carry the matched assignment, so WooCommerce rate cache no longer reuses free/reserved rates after the email changes.
Anonymous tracking endpoint no longer returns matched: true|false (enumeration oracle).
CF-Connecting-IP trusted only from Cloudflare ranges or private/loopback proxies (was: from anyone -> REST rate limit bypass, forged audit IPs).
Security review of the plugin (family-wide request). Four fixes, each with a smoke assertion and a planted-fault control that turned it red:
- Discount follows the billing email (order address); the tracked session email used to win, so a guest could post a discounted address and check out under their own.
- Shipping packages carry the matched assignment, so WooCommerce rate cache no longer reuses free/reserved rates after the email changes.
- Anonymous tracking endpoint no longer returns matched: true|false (enumeration oracle).
- CF-Connecting-IP trusted only from Cloudflare ranges or private/loopback proxies (was: from anyone -> REST rate limit bypass, forged audit IPs).
Local: static green, selftest 61/61, site-test 89/89 on WP 7.1.4 + WC 11.3.0.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
- The discount follows the billing email, the address the order is
placed under. The tracked session email used to win, so a guest could
post a discounted address to the tracking endpoint and check out under
their own, keeping the discount.
- Shipping packages carry the matched assignment, so WooCommerce's
per-package rate cache no longer reuses rates filtered for a matched
address (free shipping, reserved methods) after the email changes.
- The anonymous tracking endpoint no longer answers matched: true|false,
which let anyone enumerate discounted addresses and domains.
- CF-Connecting-IP is believed only from a Cloudflare edge range or a
private/loopback proxy. From anyone else it let a direct client pick a
new address per request: no REST rate limit, forged audit-log IPs.
Smoke tests: 89 assertions (was 73), each fix with its own.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
kw
merged commit b9d8611ce2 into main2026-11-14 14:32:42 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Security review of the plugin (family-wide request). Four fixes, each with a smoke assertion and a planted-fault control that turned it red:
Local: static green, selftest 61/61, site-test 89/89 on WP 7.1.4 + WC 11.3.0.
🤖 Generated with Claude Code