WP Manifestindependent plugin directory
manifest / admin / rawb-wordpress-search-dashboard

RAWB Search Dashboard WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Dashboard for the search services

by Camilo Tapia · github.com/24hr-malmo/rawb-wordpress-search-dashboard · website

★ 0stars
v0.1.1latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/24hr-malmo/rawb-wordpress-search-dashboard/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/24hr-malmo/rawb-wordpress-search-dashboard ↗
Search Dashboard for WP

Releases

2 releases.

Tag
Published
v0.1.1 latest
Sep 12, 2022 4 years ago
v0.1.0
Dec 3, 2020 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

RAWB Search Dashboard 0.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.1.1
Findings
1
Worst severity
high
Content hash
58aa85448e2f5d3c190f0468…

Findings

  • high Unauthenticated direct-access sync endpoints

    ajax/sync.php and ajax/check-sync.php bootstrap WordPress and process $_POST api_path/release/sync_check through DraftLiveSync with no current_user_can, nonce, or shared-secret check. Anyone who can reach the plugin URL can enqueue sync jobs using the server-side API_TOKEN.

    ajax/sync.php:39-70

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →