WP Manifestindependent plugin directory
manifest / content / chat-to-blog

Chat to Blog WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

WordPress plugin to Import media from Beeper group chats and create blog posts

★ 2stars
161release downloads
0.9.5latest · 7mo ago

Install

Download chat-to-blog.zip From the 0.9.5 release on GitHub, Mar 17, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/akirk/chat-to-blog/releases/download/0.9.5/chat-to-blog.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Import photos and videos from your Beeper chats and turn them into WordPress posts with gallery or individual media blocks.

Description

Chat to Blog connects to the Beeper Desktop local API to browse images and videos from your chat conversations. Select media items, arrange them as you like, and publish them directly as WordPress blog posts with gallery or individual image blocks.

Pick a chat from the horizontal chat bar, scroll or jump to a month in the timeline, and click the pictures you want. Selected media collects in a panel on the right where you can drag it into the order you want, give the post a title and some text, choose a category and a date, and then save a draft or publish. Everything you pick is imported into the WordPress Media Library along with the caption, sender and timestamp from the chat, and the post is built from standard Gutenberg image, gallery and video blocks — so the result is an ordinary WordPress post you can keep editing in the block editor.

Because Beeper Desktop's API only listens on localhost, the browser talks to it directly and hands the media to WordPress, which means the WordPress site itself never needs network access to your chats.

Features

  • Browse all your Beeper chats and group conversations
  • View and select images and videos from chat messages
  • Support for multiple image formats: JPEG, PNG, GIF, WebP, HEIC/HEIF, AVIF, BMP, TIFF, SVG
  • Support for multiple video formats: MP4, MOV, WebM, AVI, MKV, 3GP
  • Videos display with play icon overlay and VIDEO badge for easy identification
  • Drag and drop to reorder selected media
  • Create posts as galleries or individual image/video blocks
  • Videos are embedded as native WordPress video blocks with controls
  • Mixed galleries: images grouped in gallery, videos added as separate blocks
  • Automatic duplicate detection (won't re-import the same media twice)
  • Set custom post dates for backdated publishing
  • Import media into the Media Library without creating a post
  • Choose which post types Chat to Blog appears on and can post to
  • Media is imported to the WordPress Media Library with full metadata

Requirements

  • Beeper Desktop running on the same machine as the browser you use for WordPress
  • A Beeper API token (generated from Beeper Desktop settings)

Installation

  1. Upload the chat-to-blog folder to /wp-content/plugins/
  2. Activate the plugin through the WordPress admin
  3. Go to Settings > Chat to Blog to configure your Beeper connection

Beeper API Token

  1. Open Beeper Desktop on your computer
  2. Go to Settings (gear icon)
  3. Click Developers in the sidebar
  4. Turn on the Beeper Desktop API toggle (the API starts on localhost:23373)
  5. Scroll to Approved connections and click the + button to generate a token
  6. Paste the token in the Chat to Blog settings page

Frequently Asked Questions

How do I create a post?

Go to Posts > Chat to Blog in the WordPress admin, select a chat from the horizontal chat list at the top, click images to select them (they appear in the right panel), drag to reorder them if needed, enter a post title and optional text, choose between the Gallery and Individual images format, and click Save Draft or Publish.

Does my WordPress site need to reach Beeper?

No. The Beeper Desktop API only listens on localhost, so the media is fetched by your browser and passed to WordPress from there. This does mean the admin page has to be open on the same machine where Beeper Desktop is running.

Will the same picture be imported twice?

No. Every imported attachment stores the chat media identifier it came from, and already-imported media is shown with a dimmed overlay so you can see at a glance what has been used before.

Can I post to a custom post type?

Yes. On the settings page you can enable any public post type. Chat to Blog then appears in that post type's menu and can create entries of that type.

How are videos handled?

Videos are marked with a play icon and a "VIDEO" badge in the browser. They are imported to the Media Library like images and embedded as native WordPress video blocks with controls. When using the Gallery format with mixed media, the images are grouped in the gallery and the videos are added below as individual blocks.

How do I load older media?

Scroll to the end of a chat's media to fetch older messages, or use the timeline above the grid to jump straight to a month.

Can I import media without creating a post?

Yes. Select the media and use Import Without Posting to add it to the Media Library only.

How can I translate the plugin?

The plugin is fully translatable. Generate a .pot file with a tool like Poedit or WP-CLI, put translations in the languages/ directory named chat-to-blog-{locale}.po and .mo, and generate the JSON file used for the JavaScript strings with wp i18n make-json languages/chat-to-blog-{locale}.po --no-purge.

Screenshots

  1. Browsing chat media and composing a post from the selected images.
  2. The settings screen on a phone: the Beeper connection steps and the API token field, one column deep.

Changelog

0.9.4

  • Match the launcher icon to the catalog entry.
  • Improved Beeper onboarding and a clearer error when Beeper Desktop cannot be reached.
  • Timeline for jumping to a month within a chat.
  • Import media without creating a post.
  • Support for multiple post types.

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.9.5 latest
Mar 17, 2026 7mo ago
chat-to-blog.zip
68
Jan 29, 2026 8mo ago
chat-to-blog.zip
80
Jan 29, 2026 8mo ago
chat-to-blog.zip
2
Jan 29, 2026 8mo ago
chat-to-blog.zip
4
Jan 27, 2026 8mo ago
chat-to-blog.zip
5
Jan 23, 2026 9mo ago
chat-to-blog.zip
2
B grade

Security

Chat to Blog 0.9.4 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.9.4
Findings
1
Worst severity
medium
Content hash
5b03fc6d45fc12bfeb27a91a…

Findings

  • medium Author+ create-post AJAX re-parents other users' imported attachments by mxc URL

    missing_capability

    ajax_create_post is reachable by any logged-in user with edit_posts and upload_files (default Author+) after a chat_to_blog nonce. The handler accepts a JSON images array of {mxcUrl, dataUrl}. If MediaImporter::is_imported() finds that mxcUrl in the site-wide _chat_to_blog_mxc_url index, it reuses that attachment ID and skips the upload. Those mxc URLs are handed to every edit_posts user in ctbConfig.importedUrls on the Chat to Blog admin screen. After creating/updating the attacker's post, the handler loops every collected attachment ID and wp_update_post()s post_parent to the new post with no current_user_can('edit_post', $attachment_id) and no ownership check. Default Authors cannot otherwise edit another author's attachments (they lack edit_others_posts). Observable result: the original post loses the attachment in get_attached_media() / the Media Library 'Uploaded to' column, and the attacker's post both embeds and now owns the file. Newly uploaded files from base64 still go through wp_upload_bits (extension allowlist), so this is not an unfiltered-upload/RCE path; it is broken access control on existing attachments. ajax_get_chats/ajax_get_media are nonce-only but are not included here because they use the caller's own Beeper token, which only manage_options can set.

    includes/class-admin.php:91-98,344-351,458-464

    Recommendation

    Only set post_parent on attachments the current user just inserted, or gate each wp_update_post with current_user_can('edit_post', $attachment_id). Do not treat a client-supplied mxcUrl as a capability-free handle to another author's attachment. Stop localizing the full site-wide imported-URL list to roles that should not see other users' chat media identifiers; query per-user or per-post instead.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.