WP Manifestindependent plugin directory
manifest / users / members-post-type

Members post type WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

Manage members on WordPress as post type.

by BE API Technical team · github.com/beapi/members-post-type · website

★ 10stars
1.0.9latest · 9 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/beapi/members-post-type/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/beapi/members-post-type ↗

Description

Manage members on WordPress as post type. Implement: post type, authentification, role, clone from WordPress.

Important to know

0.7.2

Compatibility : 4.6

If you have implemented custom views before 0.7.2, you might update them. Especially because _wpnonce => _mptnonce and wp_verify_nonce => mpt_verify_nonce. Find an exemple here.

0.7.0

Compatibility : 4.4

If you use the roles and capabilities you have to migrate all data from meta for taxonomies to WordPress native functions. To do so, download the meta for taxonomies plugin and let the plugin migrate the data for you.

Changelog

1.3.5 - 25 Apr 2025

  • Add new filter mpt_view_account_pages_query_args to customize account's pages query args.

1.3.4 - 15 Apr 2025

  • Add firstname and lastname constant for the validation new email

1.3.3 - 07 Apr 2025

  • Hide registration link if option is empty

1.3.2 - 27 Mar 2025

  • Trim 2FA code sended by user

1.3.1 - 26 Mar 2025

  • Set "Role" taxonomy to be hierarchical.

1.3.0 - 18 Mar 2025

  • Add options to customize and translate two-factor email.

1.2.0 - 14 Mar 2025

  • Add option to send emails as HTML instead of plain text.

1.1.4 - 20 Feb 2025

  • Add support for password toggle

1.1.3 - 19 Feb 2025

  • fix resend notification for registration
  • add new dynamic variable to display current site's url
  • fix date format for the activity log
  • fix user os for the activity log
  • fix user browser for the activity log
  • update translation
  • hide fields after password reset
  • add a redirection to the correct language when updating the language from the user profile. (PLL)

1.1.2 - 6 Feb 2025

  • skip two-factor shortcode rendering for admin/ajax/rest requests
  • fix extraneous chevron in shortcode template

1.1.1 - 5 Feb 2025

  • fix condition in account shortcode

1.1.0 - 5 Feb 2025

  • account editing for members
  • email change validation
  • support for polylang
  • two-factor authentication

1.0.10 - 4 Nov 2017

  • Ensure to send all admin notifications.

1.0.9 - 7 Sept 2017

  • Add first name and last for user password reset notification.

1.0.8 - 25 April 2017

  • replace do_action() with apply_filters() cause you MUST NOT echo in shortcode handler

1.0.7 - 19 April 2017

  • add useful do_action() on login tpl
  • increment versions and make it the same as release

1.0.5 - 13 Mar 2017

  • fix undefined var

1.0.4.2 - 02 Mar 2017

  • composer support

1.0.3 - 15 Feb 2017

  • Fix textdomain for errors notification.

1.0.2 - 5 Dec 2016

  • Fix wrong mapping %%user_name%% value.

1.0.1 - 5 Dec 2016

  • Fix wrong default register notification.

1.0.0 - 28 Nov 2016

  • Add for email notifications the available replacements values which are automatically replaced before email send.
  • Update the .pot and French po/mo.

0.7.2 - 5 Oct 2016

  • mpt_nonce_field() method for nounce generating has been integrated to decorrelate members and WordPress users on one hand, and to not share the same cookie for all connected members, as before, in other hand.

0.7.1 - 10 Mar 2016

  • Fix missing mpt_verify_nonce.

0.7.0 - 10 Fev 2016

  • Update the way roles and capabilities works with members.

Releases

11 releases.

Tag
Published
1.0.9 latest
Sep 7, 2017 9 years ago
1.0.8
Apr 25, 2017 9 years ago
1.0.7
Apr 19, 2017 9 years ago
1.0.6
Apr 5, 2017 9 years ago
1.0.5
Mar 13, 2017 9 years ago
1.0.4.2
Mar 2, 2017 9 years ago
1.0.3
Feb 15, 2017 9 years ago
1.0.2
Dec 16, 2016 9 years ago
1.0.1
Dec 5, 2016 9 years ago
1.0.0
Nov 28, 2016 9 years ago
0.7.2
Oct 5, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Members post type 1.0.9 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
1.0.9
Findings
3
Worst severity
high
Content hash
d67f2f6715efe9e33968a8a3…

Findings

  • high Production-shipped tools/ bootstrap scripts create members and mutate roles without authentication

    dev_tool_in_production

    Four PHP files under tools/ require wp-load.php via a relative path and run with no capability or nonce checks. register.php calls MPT_Member_Utility::create_member('beapi', 'beapi!56', ...). login.php attempts signon with hardcoded credentials and dumps the session. roles.php and member.php add/remove roles and capabilities. There is no .htaccess or index guard; if the plugins directory is web-reachable (default), an unauthenticated visitor hitting these URLs executes the scripts.

    tools/register.php:1-8

    Recommendation

    Delete tools/ from distributed packages, or deny HTTP access (e.g. .htaccess Require all denied) and gate any remaining scripts behind manage_options + nonces. Rotate any credentials that may have been created on installs where these were hit.

  • high tools/login.php and tools/roles.php are unauthenticated wp-load entry points

    dev_tool_in_production

    login.php loads WordPress and either dumps the current member or signs on with hardcoded username/password. roles.php adds capabilities and removes roles without authentication. Same direct-access class as register.php.

    tools/login.php:1-15

    Recommendation

    Remove tools/ from the plugin package shipped to production sites.

  • medium Open redirect on member logout via unvalidated redirect_to

    unsafe_input

    MPT_Main::init() handles mpt-action=logout and redirects to $_REQUEST['redirect_to'] without wp_validate_redirect(). Login shortcode correctly validates redirects; logout does not. An attacker can craft a logout URL that sends the browser to an external phishing site after ending the member session.

    classes/class-main.php:81-94

    Recommendation

    Pass redirect_to through wp_sanitize_redirect() and wp_validate_redirect( $url, home_url('/') ) as the login handler already does.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →