WP Manifestindependent plugin directory
manifest / ai / classifai

ClassifAI WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+ #2 in AI

Supercharge WordPress Content Workflows and Engagement with Artificial Intelligence.

★ 714stars
22krelease downloads
≈4.5kactive sites
3.9.0latest · 3mo ago

Install

Download classifai.zip From the 3.9.0 release on GitHub, Jul 15, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/10up/classifai/releases/download/3.9.0/classifai.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

ClassifAI

Supercharge WordPress Content Workflows and Engagement with Artificial Intelligence.

You can learn more about ClassifAI's features at ClassifAIPlugin.com and documentation at the ClassifAI documentation site.

Overview

Tap into leading cloud-based services like OpenAI, Microsoft Azure AI, Google Gemini and IBM Watson to augment your WordPress-powered websites. Publish content faster while improving SEO performance and increasing audience engagement. ClassifAI integrates Artificial Intelligence and Machine Learning technologies to lighten your workload and eliminate tedious tasks, giving you more time to create original content that matters.

Features

Language Processing

Tagging Recommended Content Excerpt Generation Comment Moderation
Screenshot of ClassifAI post tagging Screenshot of ClassifAI recommended content Screenshot of ClassifAI excerpt generation Screenshot of ClassifAI comment moderation
Audio Transcripts Title Generation Expand or Condense Text Text to Speech
Screenshot of ClassifAI audio transcript generation Screenshot of ClassifAI title generation Screenshot of ClassifAI expand/condense text feature Screenshot of ClassifAI text to speech generation
Key Takeaways Content Generation
Screenshot of the ClassifAI Key Takeaways block Screenshot of the ClassifAI Content Generation Feature

Image Processing

Alt Text Smart Cropping Tagging Generate Images
Screenshot of ClassifAI alt-text Screenshot of ClassifAI smart coppring Screenshot of ClassifAI image tagging Screenshot of ClassifAI image generation

Requirements

Pricing

Note that there is no cost to using ClassifAI itself. For detailed pricing information, please refer to the ClassifAI documentation site.

Installation

Detailed installation instructions can be found on the ClassifAI documentation site.

Register ClassifAI account

ClassifAI is a sophisticated solution that we want organizations of all shapes and sizes to count on. To keep adopters apprised of major updates and beta testing opportunities, gather feedback, support auto updates, and prioritize common use cases, we're asking for a little bit of information in exchange for a free key. Your information will be kept confidential.

For detailed instructions on how to register for a ClassifAI account, please refer to the ClassifAI documentation site.

Set up Features

ClassifAI implements a variety of Features that can be configured and used to augment your WordPress-powered websites. For detailed instructions on how to set up each Feature, please refer to the ClassifAI documentation site.

If you want to more securely manage credentials for a specific Feature, you can use the built-in filters to override AI credentials.

Run locally hosted LLMs

Some of the Features in ClassifAI can be set up to use locally hosted LLMs. This has the benefit of complete privacy and data control, as well as being able to be run without any cost. The trade-offs here are performance isn't as great and results may also be less accurate.

For full instructions on how to set up locally hosted LLMs, please refer to the ClassifAI documentation site.

WP CLI Commands

Check out the ClassifAI docs for instructions on how to use the WP CLI commands.

Frequently Asked Questions

For a full list of frequently asked questions, please refer to the ClassifAI documentation site.

Where do I report security bugs found in this plugin?

Please report security bugs found in the source code of the undefined plugin through the Patchstack Vulnerability Disclosure  Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.

Building and Running Documentation Site

The ClassifAI documentation site is built using WP Hooks Documentor. Follow these steps to build and run the documentation site locally:

1. Build Documentation

# Install dependencies and build the plugin
npm i && npm run build:docs

This will:

  • Install all required dependencies
  • Process all hook documentation from the codebase
  • Generate the documentation site in the ./docs directory

2. Run Documentation Site Locally

# Navigate to docs directory and start the server
cd ./docs && npm run serve

The documentation site will be available at http://localhost:3000.

3. Deployment

The documentation site will automatically deploy to GitHub Pages when changes are merged into the trunk branch. You can view the live documentation at https://10up.github.io/classifai/.

Support Level

Active: 10up is actively working on this, and we expect to continue work for the foreseeable future including keeping tested up to the most recent version of WordPress. Bug reports, feature requests, questions, and pull requests are welcome.

Changelog

A complete listing of all notable changes to ClassifAI are documented in CHANGELOG.md.

Contributing

Please read CODE_OF_CONDUCT.md for details on our code of conduct, CONTRIBUTING.md for details on the process for submitting pull requests to us, and CREDITS.md for a listing of maintainers, contributors, and libraries for ClassifAI.

Like what you see?

Work with the 10up WordPress Practice at Fueled

Releases

Newest 25 of 41 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
3.9.0 latest
Jul 15, 2026 3mo ago
classifai.zip
465
Jun 3, 2026 4mo ago
pr-1032-0355f5b51ac4ebf66e7de7b0a5409e5be0077292.zip +9 assets
17
pr-1032-0355f5b51ac4ebf66e7de7b0a5409e5be0077292.zip3
pr-1122-d54d78ff11b2b500a8d663c3e5485c741c3f1527.zip3
pr-1125-2a3d9f4161c68f4ebf0d78494ba43b00710e66d6.zip2
pr-1127-2fdefffd4cb2a859dfb5d0cb905d0d825c35756d.zip2
pr-1127-1171021d6e3e7c900a8cf9785560bfb0adbe099e.zip2
pr-1102-d934abeb84489d5a896fbce47a5da7b3c5ea4167.zip1
pr-1102-98430e5f417491558f58bc1137073baea8a2f5ef.zip1
pr-1119-292fc2c67d989427315c4dac8def410b53415543.zip1
pr-1123-3741b273ee1284f0fc41b453b7d7c0948bf3e8eb.zip1
pr-1119-1f3d11078e4d0009746b1dede8f9465378caeabf.zip1
Mar 20, 2026 7mo ago
classifai.zip
2,882
Jan 12, 2026 9mo ago
classifai.zip
6,772
Sep 15, 2025 1 year ago
classifai.zip
7,067
Aug 21, 2025 1 year ago
classifai.zip
116
Jul 14, 2025 1 year ago
classifai.zip
4,484
Jun 12, 2025 1 year ago
classifai.zip
22
Mar 12, 2025 1 year ago
tag only
—
Feb 20, 2025 1 year ago
tag only
—
Dec 18, 2024 1 year ago
tag only
—
Aug 6, 2024 2 years ago
tag only
—
Jul 15, 2024 2 years ago
tag only
—
Mar 7, 2024 2 years ago
tag only
—
Feb 29, 2024 2 years ago
tag only
—
Jan 11, 2024 2 years ago
tag only
—
Dec 13, 2023 2 years ago
tag only
—
Nov 9, 2023 2 years ago
tag only
—
Sep 5, 2023 3 years ago
tag only
—
Jul 13, 2023 3 years ago
tag only
—
Jun 28, 2023 3 years ago
tag only
—
Jun 8, 2023 3 years ago
tag only
—
May 22, 2023 3 years ago
tag only
—
May 2, 2023 3 years ago
tag only
—
Apr 5, 2023 3 years ago
tag only
—
All releases on GitHub →

Active-site estimate ≈4,480 comes from the median of recent superseded releases. Method.

D+ grade

Security

ClassifAI 3.9.0 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
3.9.0
Findings
3
Worst severity
high
Content hash
094d79e042419443b1e0aa5d…

Findings

  • high Classic Editor classify action missing edit_post check allows Contributor+ IDOR

    missing_capability

    admin_post_classifai_classify_post is registered from Classification::feature_setup() whenever the current user has feature access. The handler verifies only nonce classifai_classify_post_action (user-wide, not post-specific) then takes post_id from GET. It never calls current_user_can('edit_post', $post_id). The matching REST route /classifai/v1/classify/(id) correctly requires edit_post. After an administrator enables Classification with default roles (all editable roles except subscriber), a Contributor or Author who can edit one of their own posts obtains the nonce from the Classic Editor metabox and can classify any post: update _classifai_process_content, run the configured provider, and save() which links/sets terms on that post. Observable: another author's published post tags/categories change; billed provider API calls fire.

    includes/Classifai/Features/Classification.php:539-587

    Recommendation

    After the nonce check, require current_user_can('edit_post', $post_id) (and is_feature_enabled()) before mutating meta or calling save(). Mirror classify_permissions_check(). Bind the nonce to the post ID (wp_create_nonce('classifai_classify_post_action_' . $post_id)).

  • high Bulk and row actions process arbitrary posts and attachments without capability checks

    missing_capability

    language_processing_actions_handler and media_processing_bulk_action_handler iterate attacker-supplied IDs from edit.php / upload.php bulk (and row-action links that reuse the bulk-posts nonce) with no current_user_can('edit_post', $id) per item. Core's own bulk trash/delete handlers check caps; this plugin's custom actions do not. A Contributor/Author who can open the posts or media list can add other IDs to the POST body. Consequences: Classification::save assigns terms on others' posts; ExcerptGeneration wp_update_post overwrites post_excerpt (theme/RSS consumer); TextToSpeech::save writes mp3 attachments and AUDIO_ID_KEY (frontend player via the_content); ImageCropping::save put_contents overwrites thumbnail files and wp_update_attachment_metadata; DescriptiveTextGenerator::save writes _wp_attachment_image_alt. Same role gate as other features: subscriber is excluded, Contributor+ with the feature enabled is enough.

    includes/Classifai/Admin/BulkActions.php:150-228, 431-518

    Recommendation

    In both bulk handlers, skip any ID the current user cannot edit_post. Re-check is_feature_enabled() inside the handler, not only when registering the bulk label. For media actions also require upload_files.

  • medium Comment moderation admin_init action missing edit_comment allows unapproving arbitrary comments

    missing_capability

    maybe_moderate_comment runs on admin_init when the Moderation feature is enabled for the current user. It verifies nonce action moderate_comment (not bound to a comment ID) and then moderate_comment() → save_comment() which wp_update_comment(comment_approved=0) and writes classifai_moderation_flagged / classifai_moderation_flags. The REST /classifai/v1/moderate route correctly requires current_user_can('edit_comment', $id). edit-comments.php is available to anyone with edit_posts (Contributor+). The row-action nonce is the same for every comment, so the c parameter can be swapped for any comment on the site. Observable: arbitrary comments become unapproved in wp_comments and disappear from the public comment list.

    includes/Classifai/Features/Moderation.php:231-245

    Recommendation

    Require current_user_can('edit_comment', $comment_id) (or moderate_comments) after the nonce check. Create the nonce as moderate_comment_{id}. Apply the same object-level check in bulk_action_handler_comments.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.