WP Manifestindependent plugin directory
manifest / users / b3-onboarding

B3 OnBoarding WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

This Wordpress plugin handles the onboarding of a user (registration + login)

★ 4stars
3.19.0latest · 2mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/beee4life/b3-onboarding/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This plugin styles the default WordPress pages into your own design. It gives you full control over the registration/login process (aka onboarding).

Description

This plugin was built to 'onboard' (in other words register/add) users to your site in the smoothest way possible.

You can customize every aspect of the onboarding process, such as control the look and feel of any email sent out by the website.

There are a ton of things, which you can set through the admin pages or with the help of actions/filters

Installation

  1. Download the latest release.
  2. Copy the b3-onboarding folder into your wp-content/plugins folder.
  3. Activate the B3 OnBoarding plugin via the plugins admin page. If you run a multisite, it needs to be network activated.
  4. (optional) Change any setting you want.

Changelog

3.19.0

  • improve download of default template/css
  • improve message above login on magic link + password option
  • disable filtered input settings
  • add admin users tab for multisite
  • fix magic link for multisite
  • added a lot of improvements for WPMU and user approval
  • improved error messaging for WPMU
  • do single site user validation in one function

3.18.0

  • add option to send test email
  • re-activated login in popup option
  • improved form messages
  • added new filters
    • b3_message_above_magic_link
    • b3_show_first_last_name_account
  • changed meta keys to reflect their function better
    • b3_activate_login_popup

3.17.0

  • added option to choose magic link or password
  • changed tab 'Template' to 'Styling'
  • added new input boxes
    • magic link message
    • magic link subject
  • added new filters
    • b3_magic_link_message
    • b3_magic_link_subject

3.16.0

  • add email replacement vars filter, so you can add previews for your own emails
  • change b3_get_user_approval_link() to b3_get_user_approval_url()
  • change meta keys to reflect their function better
    • b3_activate_debug_info
    • b3_activate_domain_restriction
    • b3_activate_front_end_approval
    • b3_activate_honeypot
    • b3_activate_privacy_page
    • b3_activate_username_restriction
  • add new filters
    • b3_activate_debug_info
    • b3_preview_email_message
    • b3_preview_email_subject
    • b3_replacement_vars
  • removed b3_redirect_after_register filter

3.15.1

  • fix incorrect option key to set password on registration

3.15.0

  • improve approval + email confirmation
  • escape and sanitize a lot
  • add nonces to forms

3.14.0

  • improve emails
  • optimize otp functions
  • optimize use of repeated wp functions
  • add language on signup

3.13.0

  • change version everywhere

3.12.2

  • change composer file

3.12.1

  • change composer version

3.12.0

  • change 'code' argument/var to 'otpcode' to avoid conflicts

3.11.1

  • fix forgotten creation of dynamic property in shortcodes file

3.11.0

  • add magic link login option (single site only, for now)
  • improved blocking of disallowed usernames/domain names
  • moved logo field to emails tab
  • added indicator for filter verification
  • added new filters
    • b3_magic_link_email()
    • b3_magic_link_time_out()
    • b3_password_special_chars()
    • b3_password_extra_special_chars()
    • b3_disallowed_domains()
    • b3_show_email_widget()
    • b3_message_above_magiclink()
    • b3_email_intro()
    • b3_message_above_request_site()
  • change settings to non-static method

3.10.0

  • filter out nav menu items
  • sprintf admin tabs
  • honour redirect_to on logout
  • array refactoring array() to []

3.9.0

  • remove jquery enqueue

3.8.2

  • change to correct version numbers

3.8.1

  • added missing readmes/versions

3.8.0

  • fix non-working contextual help tabs
  • load admin scripts later so they don't conflict with wp-themeplugin-editor
  • remove new lines in default messages
  • added more filters for multisite
  • safer downloading of example files

3.7.0

  • added codemirror for email template and styling
  • added new admin tab for email template and styling
  • add filters to style email content for "change admin email"
  • move link color field to settings tab
  • conditionally load admin.js

3.6.0

  • fix incorrect field name login
  • don't autoload options
  • output image in admin (if set by filter)
  • hide more fields which have no meaning for the current registration type

3.5.0

  • fix styling multisite registration forms
  • add new localhost filters for multisite
  • add recaptcha theme
  • add/optimize templates
  • update contextual help

3.4.0

  • add new template: lostpassword/email
  • add new filters
  • improve localhost values in forms
  • change notice text lost password form
  • 'limit' link color to email content
  • fix replace var %user_login%
  • remove redundant new line in email template
  • remove %site_url% from explanation (not used anymore)

3.3.0

  • improved welcome page redirect
  • get translated ID of privacy page if WPML is active

3.2.1

  • fixed redirect after login for admins

3.2.0

  • added development notice filter
  • added option for a one-time welcome page
  • added option for banned domains
  • added color picker for link color
  • added new hook before/after account page
  • extended more filters to preview
  • implemented checked/selected functions
  • rebuild template files with more hooks/separate files

3.1.0

  • improved multisite functions

  • added honeypot feature

  • added 'prevent delete settings on uninstall' setting

  • added new filters

  • added status class to messages

  • optimized existing filters

  • optimized user templates

  • reformatted debug info page

  • 3.0

  • added option to request access to create a site (multisite)

  • added reCaptcha v3

  • added user input for disallowed usernames

  • a lot of MU stuff

For older changelogs see the website.

Update Notice

A ton of new features, so you'd better upgrade.

Releases

Newest 25 of 47 recorded releases.

Tag
Published
3.19.0 latest
Aug 21, 2026 2mo ago
Aug 4, 2026 2mo ago
Aug 1, 2026 2mo ago
Jul 21, 2026 3mo ago
Jun 22, 2026 4mo ago
Jun 10, 2026 4mo ago
Jan 14, 2026 9mo ago
Oct 30, 2024 1 year ago
Oct 30, 2024 1 year ago
Oct 29, 2024 1 year ago
Sep 15, 2024 2 years ago
Sep 7, 2024 2 years ago
Oct 2, 2023 3 years ago
Jan 11, 2023 3 years ago
Jul 28, 2022 4 years ago
Jul 28, 2022 4 years ago
Jul 28, 2022 4 years ago
Apr 17, 2022 4 years ago
Apr 5, 2022 4 years ago
Apr 3, 2022 4 years ago
Mar 31, 2022 4 years ago
Mar 29, 2022 4 years ago
Mar 24, 2022 4 years ago
Mar 24, 2022 4 years ago
Mar 6, 2022 4 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

B3 OnBoarding 3.19.0 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
3.19.0
Findings
3
Worst severity
high
Content hash
5ca01a1402d65d32c7388d19…

Findings

  • high User approve/reject handler lacks capability check

    missing_capability

    b3_approve_deny_users runs on init whenever b3_manage_users_nonce is posted. After nonce verification it can approve users or call wp_delete_user/wpmu_delete_user without current_user_can('promote_users') or manage_options. The [user-management] UI checks promote_users before rendering the nonce, but the state-changing handler does not re-check capability, so any request bearing a valid nonce (CSRF against an editor/admin, or nonce leakage) can delete or approve accounts.

    includes/form-handling.php:714-815

    Recommendation

    Require current_user_can( apply_filters( 'b3_user_cap', 'promote_users' ) ) (or manage_options) in the same handler before approve/reject/delete.

  • medium Admin settings form handlers rely on nonce without capability check

    missing_capability

    Multiple init-hooked handlers (b3_registration_tab_form_handling, b3_email_tab_form_handling, b3_setings_tab_form_handling, etc.) update sensitive options (users_can_register, registration type, reCAPTCHA secrets, email templates) after wp_verify_nonce only. Admin UI is gated by manage_options, but handlers do not call current_user_can, weakening CSRF/defense-in-depth for privileged configuration.

    includes/form-handling.php:4-149

    Recommendation

    Add current_user_can( apply_filters( 'b3_user_cap', 'manage_options' ) ) to every admin settings handler before updating options.

  • low admin_post download lacks capability and nonce

    missing_capability

    admin_post_b3_download serves default email CSS/HTML templates to any logged-in user with no capability or nonce check. Files are static plugin defaults (allowlisted), so blast radius is limited information disclosure.

    includes/actions-wp.php:248-292

    Recommendation

    Require manage_options and a nonce (or capability check matching the admin UI) before streaming files.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.