WP Manifestindependent plugin directory
manifest / media / featherlift-media

FeatherLift Media WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

WordPress advance media manager for Optimization and Alt Tag Generation

★ 0stars
66release downloads
v1.1.20latest · 1mo ago

Install

Download featherlift-media-v1.1.20.zip From the v1.1.20 release on GitHub, Sep 27, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/amagraphs-in/featherlift-media/releases/download/v1.1.20/featherlift-media-v1.1.20.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

FeatherLift Media (formerly Enhanced S3 Media Upload) is a WordPress plugin that lets teams optimize images, offload media to Amazon S3, and serve assets through CloudFront with optional SQS-based automation. The plugin also ships with AI helpers for alt text, bulk processing utilities, and an opinionated release pipeline powered by GitHub Actions.

Key Capabilities

  • Toggleable media optimization (resize + compression) and offload/CDN workflows
  • Guided AWS provisioning for S3 buckets, SQS queues, and CloudFront distributions
  • Background queue management with granular progress logging
  • Manual and bulk media controls inside the WordPress Media Library
  • Optional AI-generated alt tags with provider/model selection
  • Automated GitHub release packaging on semantic tags (v*)

Installation

  1. Clone or download this repository into your WordPress wp-content/plugins directory.
  2. Activate FeatherLift Media from the WordPress Plugins screen.
  3. Open Media → FeatherLift Media to configure AWS credentials, optimization rules, and automation preferences.

Configuration Checklist

  • AWS access key, secret, and preferred region
  • Bucket naming strategy and prefix (if required)
  • CloudFront domain / distribution ID (manual or auto-provisioned)
  • Optional TinyPNG API key and resizing caps (default 2560px max width)
  • Automation strategy for future uploads plus bulk tooling for backfills
  • AI provider credentials (OpenAI, Anthropic, or custom endpoint)

Release Workflow

  1. Commit changes to master.
  2. Bump the plugin version header and $version property.
  3. Tag the release using the format vX.Y.Z.
  4. Push master and the tag (git push origin master && git push origin vX.Y.Z).
  5. GitHub Actions (.github/workflows/release.yml) builds the distributable ZIP and publishes it as a GitHub Release.

Release Notes

v1.1.10 — 2026-09-13

  • Store the persistent credential encryption key as safe hexadecimal text and migrate intact prior keys, preventing database encoding from corrupting newly saved AWS and AI credentials.

v1.1.9 — 2026-09-13

  • Store newly saved AWS and AI credentials with a persistent per-site encryption key, so they remain readable when WordPress salts vary between requests.

v1.1.8 — 2026-09-12

  • Fix fallback credential encryption so its key remains stable between requests, and reject any secret that cannot complete an encryption/decryption round trip when saved.

v1.1.7 — 2026-09-12

  • Require the ama-public-na S3 bucket and an existing CloudFront domain, and add a combined S3 upload and CloudFront delivery setup test.
  • Preserve AI credentials during AWS-only resets and report whether AWS or AI keys are stored but cannot be decrypted.

v1.1.6 — 2026-09-12

  • Surface actionable OpenAI alt-text errors in the Media Library and distinguish missing AWS credentials from encrypted credentials that cannot be read.

v1.1.5 — 2026-09-12

  • Fixed configuration reset actions by registering their missing WordPress AJAX handlers, clearing conflicting CDN state, and preserving local and S3 media copies.
  • Corrected the settings summary so configured AWS infrastructure is not reported as an unconfigured plugin when no optional workflow has been selected.

v1.1.4 — 2026-09-11

  • Made S3/CloudFront uploads non-destructive: WordPress originals, attachment metadata, and URL delivery can now be retained and switched independently.
  • Added duplicate-job protection, page-level bulk upload, and queued core/plugin/theme JavaScript and CSS uploads with stale-asset fallback to local delivery.
  • Enabled OpenAI alt-text settings and added one-by-one, bulk, and combined optimize/upload/alt-text media workflows using the smallest available image rendition.

v1.1.3 — 2026-02-23

  • Fixed FeatherLite optimizations that silently “succeeded” when both resize and compression skipped the file by surfacing the underlying errors in the UI.

v1.1.2 — 2026-02-23

  • Reordered the settings experience so the quick-start checklist, IAM policy reference, and AWS summary always stay visible above the workflow cards, plus refreshed the surrounding styles.
  • Added FeatherLite pagination with AJAX-powered row loading, bulk selection controls, and helpful disabled states so large media libraries remain manageable.

v1.1.1 — 2026-02-23

  • Fixed optimize-only workflows so attachments are actually reprocessed locally even when AWS isn’t configured, and surfaced the resulting savings/timestamps inline across the settings and media screens.
  • Stopped the FeatherLite box and media modal from reloading the page after each optimization; status badges and “Last run…” summaries now update instantly via AJAX responses.

v1.1.0 — 2026-02-16

  • Decoupled optimization from offload/CDN requirements so site owners can resize/compress media locally without configuring AWS.
  • Updated FeatherLite controls plus media modal actions, enabling optimize-only or offload-only workflows with new admin JS handlers and styles.
  • Added dedicated AJAX endpoints and helper pipelines for local optimization queues, ensuring the media library, bulk tools, and background workers share the same logic.

v1.0.7 — 2026-02-16

  • Fixed a syntax error in the admin JavaScript bundle that was blocking WordPress’ media-frame scripts from rendering attachments, restoring the Media Library grid/list views.

v1.0.6 — 2026-02-16

  • Declared all legacy option fields on the main plugin class to silence PHP 8.2 dynamic property notices during bootstrap.
  • Hardened secret encryption to fall back on defined salts/keys (or a deterministic fingerprint) when wp_salt() is unavailable, preventing fatal errors when the plugin loads before WordPress pluggables.

v1.0.5 — 2026-02-16

  • Introduced the FeatherLite Optimization Box across settings, log, and bulk pages so recent uploads can be scanned, multi-selected, and queued without leaving the screen.
  • Updated the TinyPNG API key control to remain visible with contextual hints and disabled styling until the service is enabled, preventing confusion over missing fields.

v1.0.4 — 2026-02-16

  • Rebranded all plugin UI strings, notices, and documentation to FeatherLift Media while keeping legacy functionality intact.
  • Hardened the onboarding flow so optimization/offload controls stay hidden until settings are saved, and disabled AI helpers by default.
  • Simplified the admin layout to a single-column stack to avoid grid breakage and improve readability.

v1.0.3 — 2026-02-16

  • Fixed a PHP parse error introduced in the admin script enqueue logic that prevented plugin activation.
  • Confirmed assets/admin.js and assets/admin.css load correctly on all media and settings screens.

v1.0.2 — 2026-02-16

  • Added in-modal attachment description preview for quick editorial review.
  • Updated plugin version metadata to 1.0.2 and published via release pipeline.

v1.0.1 — 2025-??-??

  • Introduced automated GitHub release workflow triggered by tags.
  • Minor maintenance updates and documentation cleanup.

v1.0.0 — 2025-??-??

  • Initial public release with S3/SQS automation, optimization controls, and AI alt text features.

Updating This Document

  • Append new entries to the Release Notes section whenever you create a release tag.
  • If the release workflow changes, edit both this README and .github/workflows/release.yml to keep the process in sync.
  • For significant feature work, consider adding usage notes or configuration screenshots to help downstream teams adopt the change quickly.

Releases

Newest 25 of 28 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.20 latest
Sep 27, 2026 1mo ago
featherlift-media-v1.1.20.zip
9
Sep 26, 2026 1mo ago
featherlift-media-v1.1.19.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.18.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.17.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.16.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.15.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.14.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.13.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.12.zip
1
Sep 26, 2026 1mo ago
featherlift-media-v1.1.11.zip
1
Sep 12, 2026 1mo ago
featherlift-media-v1.1.10.zip
5
Sep 12, 2026 1mo ago
featherlift-media-v1.1.9.zip
1
Sep 12, 2026 1mo ago
featherlift-media-v1.1.8.zip
1
Sep 12, 2026 1mo ago
featherlift-media-v1.1.7.zip
1
Sep 11, 2026 1mo ago
featherlift-media-v1.1.6.zip
2
Sep 11, 2026 1mo ago
featherlift-media-v1.1.5.zip
4
Sep 11, 2026 1mo ago
featherlift-media-v1.1.4.zip
2
Feb 23, 2026 8mo ago
featherlift-media-v1.1.3.zip
8
Feb 23, 2026 8mo ago
featherlift-media-v1.1.2.zip
1
Feb 23, 2026 8mo ago
featherlift-media-v1.1.1.zip
2
Feb 16, 2026 8mo ago
featherlift-media-v1.1.0.zip
2
Feb 16, 2026 8mo ago
featherlift-media-v1.0.7.zip
1
Feb 16, 2026 8mo ago
featherlift-media-v1.0.6.zip
3
Feb 16, 2026 8mo ago
featherlift-media-v1.0.5.zip
3
Feb 16, 2026 8mo ago
featherlift-media-v1.0.4.zip
4
All releases on GitHub →
D+ grade

Security

FeatherLift Media 1.1.20 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.1.20
Findings
2
Worst severity
high
Content hash
d3a46f27bbcd5c038a227d49…

Findings

  • high S3 queue/bulk AJAX lacks capability checks beyond nonce

    missing_capability

    ajax_queue_s3_upload, ajax_queue_s3_download, ajax_bulk_s3_upload, ajax_bulk_s3_download, ajax_manual_upload_all, and ajax_retry_failed_operations only call check_ajax_referer('enhanced_s3_nonce'). The same nonce is localized on upload.php and post.php for users with upload/edit access (Contributor+), so a low-privilege editor can queue arbitrary attachment IDs for S3 upload/download, enqueue all unmigrated media, or retry failed AWS jobs without manage_options.

    featherlift-media.php:293-324,2643-2695,2781-2833

    Recommendation

    Require current_user_can('manage_options') (or at least upload_files plus edit_post on the attachment) on every state-changing S3 AJAX handler; keep the nonce check as CSRF defense only.

  • medium S3 operation logs readable via nonce-only AJAX

    information_disclosure

    ajax_get_logs, ajax_get_operation_status, and ajax_get_log_stats return rows from {$wpdb->prefix}amagraphs_s3_logs (including s3_key and unserialized job_meta) after only check_ajax_referer. Any authenticated user who can load a page that localizes enhanced_s3_nonce can enumerate offload status and object keys for all media.

    featherlift-media.php:2839-2903,4729-4760

    Recommendation

    Gate log and status AJAX with current_user_can('manage_options') to match the S3 Logs admin menu capability.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.