WP Manifestindependent plugin directory
manifest / content / bettenboerse

Bettenbörse WP RegistryMedium-severity findings · 1 findingOpen the reportB

Bettenbörse WordPress Plugin

by Lukas Mateffy · github.com/asta-luneburg/bettenboerse · website

★ 0stars
29release downloads
≈10active sites
1.1.1latest · 4 years ago

Install

Download bettenboerse-v1.1.0.zip From the 1.1.0 release on GitHub, Apr 19, 2022

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/asta-luneburg/bettenboerse/releases/download/1.1.0/bettenboerse-v1.1.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/asta-luneburg/bettenboerse ↗

Bettenbörse WordPress-Plugin

Funktionen für die AStA Bettenbörse

Screenshots

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.1 latest
Sep 12, 2022 4 years ago
tag only
—
1.1.0
Apr 19, 2022 4 years ago
bettenboerse-v1.1.0.zip
13
v1.0.2
Apr 14, 2022 4 years ago
bettenboerse-v1.0.2.zip
8
v1.0.1
Apr 14, 2022 4 years ago
bettenboerse-v1.0.1.zip
8

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

Bettenbörse 1.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.0
Findings
1
Worst severity
medium
Content hash
48858a8b0e7b31c09f4e6ff5…

Findings

  • medium Missing nonce on bettenboerse_delete_announcement AJAX (CSRF)

    csrf

    wp_ajax_bettenboerse_delete_announcement calls delete_announcement() which checks current_user_can('delete_posts') but never check_ajax_referer/wp_verify_nonce. A logged-in user with delete_posts (Author+) can be CSRF'd into deleting announcements via crafted POST to admin-ajax.php.

    includes/lib/admin/class-admin-api.php:36-52

    Recommendation

    Add check_ajax_referer (or wp_verify_nonce) with a dedicated action before deleting; localize the nonce to the admin UI script.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →