WP Manifestindependent plugin directory
manifest / users / ajdwp-user-profile

AJDWP-user-profile WP RegistryMedium-severity findings · 1 findingOpen the reportB

This plugin seamlessly installs the "User Profile" and "Password Reset" pages, complete with the embedded shortcodes ([pl_AJDWP_register_form] & [pl_password_reset_form]). Simply add the pages to your theme menu effortlessly.

by Arash Javadi · github.com/arash12javadi/ajdwp-user-profile · website

★ 0stars
240308latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/arash12javadi/ajdwp-user-profile/archive/refs/heads/Plugin.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Releases

2 releases.

Tag
Published
240308 latest
Jan 27, 2025 1 year ago
240201
Feb 1, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

AJDWP-user-profile 240310 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
240310
Findings
1
Worst severity
medium
Content hash
30e1c3476e05cf5c5859d24c…

Findings

  • medium CSRF account deletion via pl_delete_user_account

    csrf

    pl_delete_user_account verifies delete_user_nonce then deletes the current user and their posts/comments. No capability beyond excluding administrators. Nonce is embedded in the profile page, so a cross-site POST from a logged-in non-admin victim deletes their account. Also registered on wp_ajax_nopriv_.

    user_profile/pl_user_profile_functions.php:360-418

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →