[GaryJones]

Summary

Safe Report Comments lets visitors flag a comment as inappropriate, and once a configurable number of reports is reached the comment is moved to moderation. The public AJAX handler behind this, flag_comment(), validated only that the submitted comment_id was numeric and that the request carried the plugin's report nonce. That nonce is a single global value, shared by every anonymous visitor and not tied to any particular comment, so it proves only that the caller loaded a page with a report link, not that the target was ever meant to be reportable.

WordPress stores more than blog comments in the comments table. WooCommerce, for instance, keeps internal order notes there with a comment_type of order_note. Because nothing checked the target's type, an anonymous visitor could lift the global nonce from any public post and submit reports against arbitrary comment IDs, including hidden records that never had a report link rendered. On reaching the threshold the plugin called wp_set_comment_status( $comment_id, 'hold' ) on them, changing their approval state and firing the moderation hooks, with no authorisation for that specific target. This was raised in an external security report, with WooCommerce order notes as the demonstrated case.

The fix adds an is_reportable_comment() guard that flag_comment() now consults before any report metadata is written or status changed. It confirms the comment exists and is an ordinary public comment type (an empty type or comment), rejecting order notes, pingbacks, trackbacks and other subtypes that merely share the table. Two filters keep it extensible: safe_report_comments_reportable_comment_types to adjust the accepted types and safe_report_comments_is_reportable_comment to veto or allow a specific target. Rejected requests reuse the existing invalid-values response, so client behaviour for a bad request is unchanged. Extracting the check into its own method also makes it directly testable, and the new tests/test-reportable-comment.php locks in the behaviour for ordinary comments, order notes, pingbacks, trackbacks, a missing comment and both filters.

The change is deliberately narrow: it gates the target by type only. Verifying parent-post visibility (comments on private or password-protected posts) was noted in the report as a lesser, separate concern, and the safe_report_comments_is_reportable_comment filter is the intended extension point should we choose to add it. One claim in the report, that a held order note vanishes from wc_get_order_notes(), looked doubtful because WP_Comment_Query returns both approved and held comments by default; this PR closes the underlying authorisation gap regardless, since acting on a non-reportable target is wrong on its own.

Test plan

• CI runs the new integration test on PHP 7.4 and 8.3 against WordPress latest, single and multisite.
• Manual: with flagging enabled and WooCommerce active, reporting an order_note comment ID via admin-ajax.php returns the invalid-values message and leaves the note untouched, while an ordinary comment still reaches moderation at the threshold.