MWC-20330

woocommerce/changelog.txt

@@ -1,6 +1,8 @@
 *** SkyVerge WooCommerce Plugin Framework Changelog ***
 
 2026.nn.nn - version 6.2.4
+* Security - Hardened capability checks around the payment token editor's admin functionality
+* Tweak - Only load admin token editor JS on profile.php and user-edit.php pages
 
 2026.06.23 - version 6.2.3
 * Fix - Address "wp_script_is was called incorrectly" errors when instantiating the `SV_WP_Job_Batch_Handler` class

woocommerce/payment-gateway/admin/class-sv-wc-payment-gateway-admin-payment-token-editor.php

@@ -79,6 +79,16 @@ public function __construct( SV_WC_Payment_Gateway_Direct $gateway ) {
 	 */
 	public function enqueue_scripts_styles() {
 
+		global $pagenow;
+
+		if ( ! in_array( $pagenow, [ 'profile.php', 'user-edit.php' ], true ) ) {
+			return;
+		}
+
+		if ( ! current_user_can( 'manage_woocommerce' ) ) {
+			return;
+		}
+
 		$gateway = $this->get_gateway();
 		$version = $gateway->get_plugin()->get_assets_version( $gateway->get_id() );
 
@@ -212,6 +222,10 @@ public function ajax_get_blank_token() {
 
 		check_ajax_referer( 'wc_payment_gateway_admin_get_blank_payment_token', 'security' );
 
+		if ( ! current_user_can( 'manage_woocommerce' ) ) {
+			wp_send_json_error();
+		}
+
 		$index = SV_WC_Helper::get_requested_value( 'index' );
 
 		if ( $index ) {
@@ -255,6 +269,10 @@ public function ajax_remove_token() {
 				throw new SV_WC_Payment_Gateway_Exception( 'Invalid nonce' );
 			}
 
+			if ( ! current_user_can( 'manage_woocommerce' ) ) {
+				throw new SV_WC_Payment_Gateway_Exception( 'You do not have permission to perform this action' );
+			}
+
 			$user_id  = SV_WC_Helper::get_requested_value( 'user_id' );
 			$token_id = SV_WC_Helper::get_requested_value( 'token_id' );
 
@@ -292,6 +310,10 @@ public function ajax_refresh_tokens() {
 				throw new SV_WC_Payment_Gateway_Exception( 'Invalid nonce' );
 			}
 
+			if ( ! current_user_can( 'manage_woocommerce' ) ) {
+				throw new SV_WC_Payment_Gateway_Exception( 'You do not have permission to perform this action' );
+			}
+
 			$user_id = SV_WC_Helper::get_requested_value( 'user_id' );
 
 			if ( ! $user_id ) {