WP Manifestindependent plugin directory
manifest / admin / 10d-support

10 Degrees Support and Maintenance WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Management and reporting WordPress plugin for 10 Degrees support clients.

★ 1stars
1.11.1latest · 2mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/10degrees/10d-support/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

10 Degrees Support

Management and reporting WordPress plugin for 10 Degrees Support and maintenance clients.

Functionality

  • Provides a Dashboard widget to show plugin updates, website performance
  • A report of the above can be emailed to one address
  • Disables plugin and theme auto-update UI
  • Disables full site editing

Development

Run composer install to install dependencies.

REST API: Queueing Updates

The plugin provides token-protected endpoints under 10d-support/v1.

Authentication:

  • Header: X-API-Key: <td_rest_api_key>
  • Or query param: api_key=<td_rest_api_key>

Queue all pending plugin updates

POST /wp-json/10d-support/v1/updates/plugins/queue

Body params:

  • webhook_url (optional): URL to receive async completion payload
  • webhook_token (optional): sent as X-Webhook-Token on webhook request

Success response (202):

  • success: true
  • summary: Plugin updates queued.
  • job_id: <uuid>

Notes:

  • Runs asynchronously via WP-Cron.
  • If one plugin fails, remaining plugins still continue.
  • Concurrent runs are blocked for 15 minutes.

Queue WordPress core update

POST /wp-json/10d-support/v1/updates/core/queue

Body params:

  • allow_major (optional boolean): set true to allow major core updates
  • webhook_url (optional): URL to receive async completion payload
  • webhook_token (optional): sent as X-Webhook-Token on webhook request

Success response (202):

  • success: true
  • summary: Core update queued.
  • job_id: <uuid>
  • allow_major: <bool>

Shared safety checks

Queue and worker execution are blocked when:

  • WordPress is currently in maintenance mode (.maintenance present)
  • Filesystem method is not direct (credentials would be required)
  • Filesystem API initialization fails

Optional async webhook payload

When webhook_url is provided, the plugin sends:

  • success (bool)
  • job_id (string)
  • type (plugins or core)
  • updated (int)
  • failed (int)
  • summary (string)
  • site_url (string)
  • timestamp (mysql datetime)

Pushing a plugin update to clients

  1. Increment the Version in 10d-support-report.php. Please use semantic versioning.
  2. Tag a new Release on Github. See Tagging. You can tag within git but it's preferable if you create a new Tag and Release on Github.

To Do

TBC.

Releases

Newest 25 of 34 recorded releases.

Tag
Published
1.11.1 latest
Aug 6, 2026 2mo ago
Aug 6, 2026 2mo ago
Jun 9, 2026 4mo ago
Jan 31, 2026 8mo ago
Jan 31, 2026 8mo ago
Jan 31, 2026 8mo ago
Oct 20, 2025 1 year ago
Jul 23, 2025 1 year ago
Jul 22, 2025 1 year ago
Jul 22, 2025 1 year ago
Jul 22, 2025 1 year ago
Jul 22, 2025 1 year ago
Jul 21, 2025 1 year ago
Jul 21, 2025 1 year ago
Jul 21, 2025 1 year ago
Jul 21, 2025 1 year ago
Jun 21, 2023 3 years ago
Jun 21, 2023 3 years ago
Feb 4, 2022 4 years ago
Feb 4, 2022 4 years ago
Feb 4, 2022 4 years ago
Feb 4, 2022 4 years ago
Jan 28, 2022 4 years ago
Jan 28, 2022 4 years ago
Jul 20, 2021 5 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

10 Degrees Support and Maintenance 1.11.1 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.11.1
Findings
2
Worst severity
high
Content hash
e539e5096ef5bb93fbd5884c…

Findings

  • high Unauthenticated GTmetrix AJAX triggers tests and writes options

    missing_auth

    td_get_gt_metrix_report is registered for both wp_ajax and wp_ajax_nopriv with no nonce or capability check. Any visitor can force GTmetrix API calls and update_option('td_GT_metrix_test').

    lib/GtMetrixAjax.php:3-12

    Recommendation

    Require manage_options and check_ajax_referer; remove nopriv registration.

  • medium Admin settings toggles use nonce without capability check

    missing_capability

    td_carbon_squirrel_toggle and ReportRecipient::updateReportRecipient run on admin_init after wp_verify_nonce only. Any logged-in user who can mint the known nonce action can flip td_carbon_squirrel_enabled or change the report recipient email.

    lib/CarbonSquirrel.php:3-16

    Recommendation

    Add current_user_can('manage_options') before updating options.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.