Security

Wallet Central is a money UI. Every input + every endpoint hardened.

Auth Gate

WKWP_Central_Endpoint::maybe_render runs template_redirect priority 1. If is_user_logged_in() === false:

wp_safe_redirect(
    add_query_arg(
        'redirect_to',
        rawurlencode( $current_url ),
        wp_login_url()
    )
);
exit;

No content rendered. No PHP runs further. Anonymous visitors never see Wallet Central HTML.

Nonce Protection

Every form + every AJAX action carries a WordPress nonce.

Nonce TTL: 24h (WP default). Stale → server returns 403 invalid_nonce.

Action Allowlist

WKWP_Central_Settings_Ajax::handle rejects any meta key not in the allowlist:

const ALLOWED_KEYS = [
    '_wkwp_auto_topup_enabled',
    '_wkwp_auto_topup_threshold',
    '_wkwp_auto_topup_amount',
    '_wkwp_notify_credit_email',
    '_wkwp_notify_debit_email',
    '_wkwp_notify_low_balance_email',
    '_wkwp_notify_transfer_received_sms',
    '_wkwp_notify_withdrawal_paid_sms',
    '_wkwp_notify_kyc_email',
    '_wkwp_transfer_locked',
];

Unknown key → 400 invalid_key. Stops customers from writing arbitrary user meta via the settings AJAX.

Per-Key Validation

Even allowlisted keys validate values:

Rules registered via wkwp_central_settings_save_validate filter — extensible.

KYC Server-Side Enforcement

UI gates are belt-and-braces. Authoritative gates run server-side regardless of UI:

Means: even a manually-crafted curl request bypassing the UI hits the server-side check and gets rejected.

CSRF

WordPress nonces are CSRF tokens. They're tied to:

• Action name (e.g. wkwp_central_settings_save)
• User ID
• Session

Stolen URL or replayed POST from another origin will not match — wp_verify_nonce returns false → 403.

Idempotency

State-changing operations are idempotent where possible:

Means duplicate requests (network retry, double-click) never cause double-credit.

Rate Limiting

Exceeded → 429 too_many_requests with Retry-After header.

Tunable via filter wkwp_central_rate_limit_<scope>.

Headers

WKWP_Central_Endpoint::send_headers writes:

Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin

Wallet Central never embeds in iframes from other origins. Never gets cached at HTTP layer. Never sniffed for MIME confusion.

Content Security Policy

Strict CSP recommended. Default policy works:

Content-Security-Policy:
  default-src 'self';
  script-src  'self' 'unsafe-inline';
  style-src   'self' 'unsafe-inline';
  img-src     'self' data: https://secure.gravatar.com;
  connect-src 'self';
  font-src    'self' data:;
  frame-ancestors 'self';

'unsafe-inline' is unfortunately needed for inline event handlers in the legacy submodule embeds. Future versions may move to nonce-based inline scripts.

File Upload Hardening (KYC)

SQL Injection

Every DB query uses $wpdb->prepare. No raw string interpolation. Tested under WP_DEBUG.

XSS

Every render path uses one of:

• esc_html()
• esc_attr()
• esc_url()
• wp_kses_post() (for admin-controlled rich text only)

Customer-typed values (notes, full names) never rendered without escaping.

Authentication Bypass via REST API Keys

REST keys (Basic Auth consumer_key:consumer_secret) honoured only on the /wp-json/wkwp-wallet/v1/* namespace. The customer-facing AJAX surface (wp_ajax_wkwp_central_*) requires cookie auth — REST keys not accepted.

Audit Logging

State changes write rows to wkwc_wallet_transactions. Reference column carries the audit tag (bulk:<batch_id>:row:<id>, transfer:#<request_id>, withdrawal:#<row_id>).

For higher audit needs, hook wkwp_wallet_balance_changed to mirror to a SIEM:

add_action( 'wkwp_wallet_balance_changed', function( $user_id, $amount, $type, $balance_after ) {
    error_log( json_encode( [
        'event'      => 'wallet_change',
        'user_id'    => $user_id,
        'amount'     => $amount,
        'type'       => $type,
        'balance'    => $balance_after,
        'remote_ip'  => $_SERVER['REMOTE_ADDR'],
        'user_agent' => $_SERVER['HTTP_USER_AGENT'],
        'timestamp'  => current_time( 'mysql' ),
    ] ) );
}, 10, 4 );

Session Hijack Mitigation

WordPress session tokens (cookie-based) rotate on login. Wallet Central doesn't store any session secret beyond what WP already manages.

For two-factor auth, install a 2FA plugin (e.g. WordFence 2FA) — Wallet Central inherits whatever auth gate WP enforces.

Mass Assignment

Settings AJAX uses an explicit allowlist — no mass assignment possible. Form POSTs are mapped explicitly to typed fields, never extract($_POST).

Common Attack Vectors → Defence

Test Plan

1. Anon → /wallet-central/ → confirm 302 to wp-login
2. Open browser dev tools → fire Settings AJAX without nonce header → confirm 403
3. Fire Settings AJAX with bogus key → confirm 400
4. Submit Withdraw without nonce → legacy handler returns nonce-fail
5. Manually POST to OTP verify with wrong code → 401 invalid_otp
6. Burst 100 settings saves in 1 sec → confirm 429
7. Upload .exe to KYC → MIME reject

Hooks

Pen-Test Suggestions

For a third-party security audit, focus on:

• KYC file upload bypass attempts (MIME spoofing)
• OTP brute force (rate limit + bcrypt)
• API key scope escalation (read → write)
• Nonce replay across users
• QR HMAC forgery
• Withdrawal request enumeration via row IDs (should 403 for non-owner)

All of these are covered by current defences but worth re-confirming per release.

Related

• Settings
• KYC Flow
• REST API
• Architecture