WP Manifestindependent plugin directory
manifest / users / wp-user-favourites

User Favourites WP RegistryHigh-severity findings · 1 findingOpen the reportC-

A WordPress plugin for marking articles as favourites.

by Bonnier Interactive · github.com/benjaminmedia/wp-user-favourites · website

★ 0stars
5.6kcomposer installs
2.0.1latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/benjaminmedia/wp-user-favourites/archive/refs/heads/master.zip

On Packagist as bonnier/wp-user-favourites:

composer require bonnier/wp-user-favourites
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Releases

7 releases.

Tag
Published
2.0.1 latest
May 31, 2022 4 years ago
2.0.0
Jun 29, 2020 6 years ago
1.1.3
Oct 31, 2018 7 years ago
1.1.1
Oct 19, 2018 8 years ago
1.1.0
Oct 19, 2018 8 years ago
1.0.1
Oct 18, 2018 8 years ago
1.0.0
Oct 18, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

User Favourites 2.0.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.0.1
Findings
1
Worst severity
high
Content hash
b0b15a674c203a2e6a408b1b…

Findings

  • high REST favourites routes lack permission_callback (public IDOR)

    missing_permission_callback

    Five register_rest_route calls under namespace app omit permission_callback (public by default). Anyone can read/add/delete favourites for arbitrary user IDs without authentication.

    src/Http/Controller.php:21-40

    Recommendation

    Require authenticated user matching path id (or admin cap).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →