WP Manifestindependent plugin directory
manifest / content / acf-user-network

Advanced Custom Fields: User Network WP RegistryMedium-severity findings · 1 findingOpen the reportB

This ACF field is a select2 field in order to list all network's users.

by BE API Technical team · github.com/beapi/acf-user-network · website

★ 9stars
1.0.1latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/beapi/acf-user-network/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/beapi/acf-user-network ↗

This enhance Advanced Custom Field plugin by adding a custom field.

This ACF field is a select2 field in order to list all network users.

Compatibility

This ACF field type is compatible with:

  • ACF 5.0.0 and up, that means the pro version.
  • ACF 4 (not supported).

Installation

via Composer

  1. Add a line to your repositories array: { "type": "git", "url": "https://github.com/BeAPI/acf-user-network" }
  2. Add a line to your require block: "bea/acf-user-network": "dev-master"
  3. Run: composer update

Manual

  1. Copy the plugin folder into your plugins folder.
  2. Activate the plugin via the plugins admin page.
  3. Create a new field via ACF and select the User Network selector.

Changelog

1.0.1 - 11 July 2024

  • Fix: Update AJAX nonce handling for ACF 6.3.2 (#5)
  • Fix: JS error when initializing the field (#3)

1.0.0 - 6 Sept 2017

  • Initial release

Releases

2 releases.

Tag
Published
1.0.1 latest
Jul 11, 2024 2 years ago
1.0.0
Nov 14, 2017 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Advanced Custom Fields: User Network 1.0.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.1
Findings
1
Worst severity
medium
Content hash
da43921467e06df41e39d42e…

Findings

  • medium Unauthenticated AJAX user enumeration via nopriv user_network/query

    information_disclosure

    The User Network field registers wp_ajax_nopriv_acf/fields/user_network/query to the same ajax_query handler as the authenticated action. After acf_verify_ajax (nonce only; no capability check in this plugin), get_ajax_query overwrites query args to blog_id=0 / fields=all_with_meta and returns every network user as Select2 results (user_login plus names). On installs that expose an ACF form (or any render of this field) to guests, an unauthenticated attacker can obtain a uid-0 nonce and enumerate all network accounts.

    fields/acf-base.php:22-58

    Recommendation

    Remove the nopriv registration. Require a capability such as edit_users or edit_posts inside ajax_query in addition to acf_verify_ajax, and do not return network-wide user lists to unauthenticated callers.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →