WP Manifestindependent plugin directory
manifest / integrations / wp-meilisearch-content-sync

24hr Meilisearch Plugin WP RegistryMedium-severity findings · 2 findingsOpen the reportB

by Richard Sweeney · github.com/24hr-malmo/wp-meilisearch-content-sync · website

★ 0stars
399composer installs
v0.0.2latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/24hr-malmo/wp-meilisearch-content-sync/archive/refs/heads/main.zip

On Packagist as 24hr/meilisearch:

composer require 24hr/meilisearch
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/24hr-malmo/wp-meilisearch-content-sync ↗

Meilisearch Content sync plugin for WordPress

This is a simple plugin for WordPress that enables you to sync the content services with a Meilisearch instance.

This plugin assumes that you are using the https://gitlab.24hr.se/rawb/services/content-to-meilisearch-sync service, but it's not essential.

Once activated this plugin's page can be found under the tools menu at /wp-admin/tools.php?page=meilisearch-24hr-admin

To update, push a new tag to GitHub. Then login to https://packagist.org/packages/24hr/meilisearch as 24hrservices user and click 'Update'. This will fetch in the new tag.

Releases

2 releases.

Tag
Published
v0.0.2 latest
Mar 22, 2023 3 years ago
v0.0.1
Feb 7, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

24hr Meilisearch Plugin 0.0.1 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
0.0.1
Findings
2
Worst severity
medium
Content hash
6b23439b37237e4b0af018f6…

Findings

  • medium Sync handler missing capability check (nonce-only CSRF)

    csrf

    Meilisearch::triggerSync() hooked on init processes POST 24hr-sync-trigger after wp_verify_nonce only. There is no current_user_can('manage_options'). Combined with the admin form that embeds the nonce for privileged users, this is a classic admin CSRF that forces a full index rebuild.

    src/Meilisearch.php:39-54

    Recommendation

    Add current_user_can('manage_options') before syncing; prefer admin_post_ action with check_admin_referer.

  • low Meilisearch stats request disables SSL verification

    insecure_config

    AdminScreen::getMeilisearchStats() calls wp_remote_get with sslverify => false, allowing MITM on the stats response displayed in wp-admin.

    src/Admin/AdminScreen.php:104-108

    Recommendation

    Use sslverify true (default) or a pinned CA; only disable for documented local dev.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →