WP Manifestindependent plugin directory
manifest / users / wp-willow-auth

Willow Auth WP RegistryLow-severity findings · 1 findingOpen the reportA-

A WP plugin for integrating with willow auth

by Bonnier Publications · github.com/benjaminmedia/wp-willow-auth · website

★ 0stars
3.7kcomposer installs
3.2.2latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/benjaminmedia/wp-willow-auth/archive/refs/heads/master.zip

On Packagist as bonnier/wp-willow-auth:

composer require bonnier/wp-willow-auth
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/benjaminmedia/wp-willow-auth ↗
wp-willow-auth

Releases

11 releases.

Tag
Published
3.2.2 latest
May 25, 2021 5 years ago
3.2.1
Dec 9, 2020 5 years ago
3.2.0
Dec 8, 2020 5 years ago
3.1.1
Dec 4, 2020 5 years ago
3.0.1
Dec 4, 2020 5 years ago
3.0.0
Jun 30, 2020 6 years ago
1.3.1
Dec 2, 2019 6 years ago
1.3.0
Nov 28, 2019 6 years ago
1.2.0
Mar 22, 2019 7 years ago
1.1.0
Dec 12, 2018 7 years ago
1.0.0
Nov 12, 2018 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Willow Auth 3.2.2 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
3.2.2
Findings
1
Worst severity
low
Content hash
4a49f41caded9a75c0a81c4d…

Findings

  • low REST routes missing explicit permission_callback

    missing_permission_callback

    Signup/lookup/verify-subscription register without permission_callback. Intended as public app API proxying to external users service; on modern WP this triggers REST doing_it_wrong and may deny. Lookup enables email existence probing via upstream.

    src/Http/SignupController.php:13-18

    Recommendation

    Set permission_callback to __return_true explicitly if public; rate-limit lookup.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →