WP Manifestindependent plugin directory
manifest / integrations / feed-consumer

Feed Consumer WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Ingest external feeds and other data sources into WordPress

★ 10stars
9.2kcomposer installs
v1.3.0latest · 6mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/alleyinteractive/feed-consumer/archive/refs/heads/develop.zip

On Packagist as alleyinteractive/feed-consumer:

composer require alleyinteractive/feed-consumer
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Ingest external feeds and other data sources into WordPress.

Installation

You can install the package via composer:

composer require alleyinteractive/feed-consumer

Requirements

This plugin requires Fieldmanager to be installed and activated. It is also recommended to use Alley Logger as well but that is not required.

Usage

Activate the plugin in WordPress and you will see the new Feeds post type available for use:

Screenshot of feed post type

Feed Consumer is a plugin that allows you to ingest external feeds and other data sources into WordPress. It is built to be extensible and can be used to ingest data from any source that can be represented as a PHP array.

Creating a Feed

To create a feed, navigate to the Feeds post type and click Add New. You will see a form that allows you to configure the feed. The feed configuration includes the following fields:

  • Title: The name of the feed. This is used to identify the feed in the admin.
  • Processors: The processors to run on the feed. Processors are used to are classes that define the extractor, transformer, and loader to use for the feed. For more information, see Processors.

The selected processor will also display any settings for the processor's extractor, transformer, and loader.

Processors

Processors are the core of Feed Consumer. They define the extractor, transformer, and loader to use for the feed.

Out of the box, Feed Consumer includes the following processors:

  • JSON Processor: Extracts data from a JSON feed into WordPress posts.
  • RSS Processor: Extracts data from an RSS feed into WordPress posts.
  • XML Processor: Extracts data from an XML feed into WordPress posts.

Creating a Processor

add_filter( 'feed_consumer_processors', function ( array $processors ) {
    $processors[] = My_Plugin\Processor::class;

    return $processors;
} );

Extractors

Extractors will take extract data from a remote source and return it as data to be passed to a transformer. Out of the box, Feed Consumer includes JSON, XML, and RSS transformers among others that can be used to extract data from a variety of sources. You can also create your own extractor by implementing the Feed_Consumer\Contracts\Extractor interface.

Transformers

Transformers will take extracted data and transform it into a format that can be loaded into WordPress. Out of the box, Feed Consumer includes a Post_Loader that will take transformed data and load it into WordPress as posts. You can also create your own transformer by implementing the Feed_Consumer\Contracts\Transformer interface.

Loaders

Loaders will take transformed data and load it where configured. Out of the box, the Post_Loader will be the most common loader used to take transformed data and load it into WordPress as posts.

You can also create your own loader by implementing the Feed_Consumer\Contracts\Loader interface.

Post Loader

The post loader will take transformed data and load it into WordPress. It will also transform the content into Gutenberg blocks by default via wp-block-converter.

Integrations

Byline Manager

The plugin includes an integration with Byline Manager to automatically set the byline for a post based on the feed item's author. Once the Byline Manager plugin is enabled, the settings fields will appear on the feed to set the default byline and to optionally use the feed item's author as the byline.

Hooks

feed_consumer_run_complete

Fires when a feed has completed running. The feed ID, loaded data, and processor class are passed to the hook.

add_action( 'feed_consumer_run_complete', function ( int $feed_id, $loaded_data, string $processor ) {
    // Do something.
}, 10, 3 );

feed_consumer_extractor_error

Fires when an extractor encounters an error. The extractor response and extractor class are passed to the hook.

add_action( 'feed_consumer_extractor_error', function ( $response, \Feed_Consumer\Contracts\Extractor $extractor ) {
    // Do something.
}, 10, 2 );

feed_consumer_pre_feed_fetch

Fires when a feed is about to be fetched.

use Mantle\Http_Client\Pending_Request;
use Feed_Consumer\Contracts\Processor;

add_action( 'feed_consumer_pre_feed_fetch', function ( Pending_Request $request, Processor $processor, array $settings ) {
    // Do something.
}, 10, 3 );

feed_consumer_feed_fetch

Fires when a feed has been fetched.

use Mantle\Http_Client\Response;
use Feed_Consumer\Contracts\Processor;

add_action( 'feed_consumer_feed_fetch', function ( Response $response, Processor $processor, array $settings ) {
    // Do something.
}, 10, 3 );

Changelog

Please see CHANGELOG for more information on what has changed recently.

Credits

This project is actively maintained by Alley Interactive. Like what you see? Come work with us.

License

The GNU General Public License (GPL) license. Please see License File for more information.

Releases

10 releases.

Tag
Published
v1.3.0 latest
Apr 8, 2026 6mo ago
Dec 12, 2025 10mo ago
Dec 11, 2025 10mo ago
Nov 25, 2025 11mo ago
Aug 5, 2025 1 year ago
Aug 4, 2025 1 year ago
Aug 12, 2024 2 years ago
Aug 8, 2024 2 years ago
May 12, 2023 3 years ago
Jan 3, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Feed Consumer 1.3.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.3.0
Findings
1
Worst severity
high
Content hash
d30bdd655a46c2dbeb5d79fd…

Findings

  • high Author-accessible Feeds CPT fetches arbitrary URLs with wp_remote_request (SSRF)

    ssrf

    Settings::register_post_type() registers feed_consumer as public, show_in_rest true, with no capability_type/capabilities/map_meta_cap. WordPress therefore treats it like posts (map_meta_cap auto-enabled when capability_type is post and capabilities is empty), so any user with edit_posts+publish_posts (Author and above) can create and publish Feeds and save Fieldmanager meta feed_consumer_settings, including extractor.feed_url and optional HTTP basic auth. Feed_Extractor::run() then does (new Pending_Request())->get($feed_url), and Mantle Http Client issues wp_remote_request() with redirection enabled and without wp_safe_remote_get / wp_http_validate_url, so loopback, RFC1918, and 169.254.169.254 are reachable. The fetch is not admin-only: render_debug_meta_box() runs the extractor on GET of the published feed's edit screen (default feed_consumer_debug_meta_box true) and writes _transformer_debug; handle_run_now_ajax (nonce + edit_post) schedules feed_consumer_run immediately; Scheduler/Runner cron later fetch the same URL as uid 0. Post_Loader additionally lets that Author choose any public post_type and post_status (including publish) for ingested items, so the cron wp_insert_post path can create published pages the Author could not create through core. Image sideload uses media_sideload_image (wp_safe_remote_get) and is not the SSRF sink. Subscriber cannot open the CPT. No unauth write handler supplies the URL.

    src/extractor/class-feed-extractor.php:70-93

    Recommendation

    Restrict the Feeds CPT to manage_options (or a dedicated capability), set map_meta_cap explicitly, and disable show_in_rest unless a real REST schema/cap is defined. Fetch feed URLs with wp_safe_remote_get (or wp_http_validate_url) so private/loopback/link-local hosts are blocked, and do not perform the extractor GET as a side effect of rendering the debug meta box. Keep Run Now behind the same admin-level cap, not merely edit_post.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.