Sample Security Audit — Harbor & Hound Outfitters

1 · Executive Summary

Harbor & Hound's storefront is healthy; its online store is the risk. The WooCommerce instance runs on a $12 unmanaged VPS with no web application firewall, 31 outdated plugins (4 abandoned by their authors), and admin credentials shared between the owner's two laptops and a marketing contractor in another state. Card data itself never touches their servers (Stripe Elements — the right architecture, SAQ-A profile), so the headline risk isn't card theft; it's site-level takeover: skimmer injection into checkout JS, customer-list exfiltration, and reputation destruction via defacement or malvertising. During consented testing, an authentication-bypass pattern present in one abandoned plugin (CVE-public since 2024) returned the customer-order table — names, addresses, order history — without any credentials.

2 · Assets & Crown Jewels

Asset	Data held	Impact if lost/public
WooCommerce database (VPS)	11,200 customers: names, addresses, order history, partial profile data	CRITICAL breach disclosure, IN AG notification duties, customer-trust collapse
Checkout page integrity	Stripe-hosted fields, but page HTML/JS served from their VPS	CRITICAL injected JS skims card entry before it reaches Stripe (the Magecart pattern)
WordPress admin + hosting panel	Full site control	HIGH defacement, phishing pages hosted under their brand
Store email (Google Workspace, 3 seats)	Supplier terms, customer threads	HIGH invoice-fraud pivot; MFA present ✓ (one bright spot)
In-store POS (Square) on retail Wi-Fi	—	LOW Square-managed, segmented, low exposure

3 · Findings & Severity

#	Finding	Detail	Severity
F1	Abandoned plugin with public auth-bypass	"QuickCart Booster" v1.9.4 — unmaintained since 2023; public CVE; consented test returned order table unauthenticated. Live exposure of all customer records, right now.	CRITICAL
F2	No file-integrity or JS-change monitoring on checkout	A Magecart-style script injected tonight would be invisible until a customer or Stripe fraud filters noticed. Baseline: legitimate change cadence is ~weekly.	CRITICAL
F3	Shared wp-admin credentials + no per-user accounts	Owner laptops + out-of-state contractor share "admin." No audit trail, no revocation without an outage.	HIGH
F4	31 plugins pending updates; 4 abandoned	Including a form builder with a stored-XSS CVE reachable by any site visitor.	HIGH
F5	Unmanaged VPS: no patching cadence, no WAF, default SSH on :22	sshd exposed to the internet; 41,000 failed logins/month in auth.log. No brute-force protection.	HIGH
F6	Backups: weekly, same VPS disk	Compromise of the box removes the backups with it. Restore never tested.	MEDIUM
F7	Security headers absent (CSP, X-Frame-Options)	Would have materially raised the bar for checkout-injection and clickjacking.	MEDIUM
F8	"admin" username still enumerable via author archives	Grants attackers half the login for free and seeds password spraying.	LOW

4 · Threat Model — most probable attack paths

T1 · Card skimming (Magecart pattern)

wp-admin or plugin breach → 3 lines of JS added to checkout → card numbers flow to attacker's collector for months → Stripe/fraud filters eventually flag the store → chargeback liability + disclosure spiral.

T2 · Customer-table exfiltration via F1

Anyone who read the 2024 CVE write-up can pull the full order history tonight. This isn't speculative — the test produced data.

T3 · Shell upload via vulnerable plugin

F4's stored-XSS/file-upload paths → webshell → VPS fully owned → F6 means the backup disk burns too → rebuild from a two-week-old exported theme and memory.

Attack narrative · T1 mapped to MITRE ATT&CK

TA0043 Recon — WordPress + plugin fingerprinting of the live site (T1595.002 active scanning)
TA0001 Initial Access — exploit abandoned-plugin flaw (T1190 public-facing application, F1/F4)
TA0005 Defense Evasion — webshell disguised as a plugin update file (T1036 masquerading)
TA0009 Collection — checkout-page JS modified to mirror form entry (T1020 staged exfil over HTTPS to a look-alike analytics domain)
Impact — silent skim for 30–90 days; detected by card-issuer fraud correlation, not by the merchant. Median skimmer dwell time in sector reports: ≈40 days.

5 · Risk Matrix (likelihood × impact)

Impact →

LowModerateHighSevereExistential Likely

F5 spray

T2F1

T1F2

Possible

F3·F4

Unlikely

Rare

Overall 7.1/10. PCI posture is SAQ-A by architecture but effectively voided if the checkout page can't prove integrity — the skimmer risk lives in their page, not Stripe's card fields. Sector likelihood draws on published e-commerce compromise stats (Magecart-family and WordPress plugin CVE exploitation frequency).

6 · Remediation Roadmap

Day 1 — Remove F1's plugin + purge exposure window ≈ $160 labor

QuickCart uninstalled; access logs reviewed for prior hits (found: 3 crawlers, no confirmed exfil — documented for the file); db creds rotated.

Week 1 — WAF + checkout integrity monitor $20/mo + $420 setup

Cloudflare WAF in front; hourly checkout-JS hash monitor alerting the owner by text — a Magecart injection now has a 60-minute life expectancy, not 40 days.

Week 1 — Identity cleanup $0

"admin" retired; named accounts with least-privilege roles (contractor = editor only); 2FA on wp-admin + hosting panel.

Week 2 — Plugin diet + update cadence ≈ $500 labor

31 plugins → 19 (the abandoned four replaced with maintained equivalents); weekly managed-update window with staging test.

Week 2 — Harden the box ≈ $420 + $8/mo backup

SSH keys-only on a non-standard port + fail2ban; unattended security packages; nightly off-box backups with restore test.

Week 3 — Security headers + CSP report-only rollout ≈ $260

CSP in report-only → tuned → enforced on checkout; XFO/XCTO/Referrer-Policy set fleet-wide.

7 · Residual Risk Statement

After Phase 1: projected 3.0/10 (LOW-MODERATE). Remaining: third-party plugin ecosystem drift (managed by the integrity monitor + update cadence, not eliminated) and ordinary credential-phishing. Optional Phase 2: move to a managed WooCommerce host to remove server-admin burden entirely. Re-score in 90 days.