WP Manifestindependent plugin directory
manifest / content / bvi-shareadraft

BVI Share a Draft WP RegistryHigh-severity findings · 1 findingOpen the reportC-

WordPress plugin to share drafts of posts privately for review. Formerly a third party maintained plugin, bringing in house to continue as the third party is defunct.

by Big Voodoo Interactive · github.com/bigvoodoo/bvi-shareadraft · website

★ 0stars
10release downloads
v2.0.1latest · 5mo ago

Install

Download bvi-shareadraft-2.0.1.zip From the v2.0.1 release on GitHub, May 20, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bigvoodoo/bvi-shareadraft/releases/download/v2.0.1/bvi-shareadraft-2.0.1.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/bigvoodoo/bvi-shareadraft ↗

WordPress plugin to share drafts of posts privately for review. Formerly a third party maintained plugin, bringing in house to continue as the third party is defunct.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.0.1 latest
May 20, 2026 5mo ago
bvi-shareadraft-2.0.1.zip
10
2.0.0
Nov 4, 2024 1 year ago
tag only
—
C- grade

Security

BVI Share a Draft 2.0.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.0.1
Findings
1
Worst severity
high
Content hash
766cc7a484cda7591bcaf800…

Findings

  • high Draft share tokens generated with predictable uniqid()

    predictable_token

    Share keys are uniqid('baba' . $post_id . '_') which is time-based and prefixed with a known string plus post ID. An attacker who knows a draft post ID and approximate share time can brute-force the shareadraft query parameter and read unpublished content via the_posts_intercept.

    bvi-shareadraft.php:127-130

    Recommendation

    Use wp_generate_password(32,false) or random_bytes/bin2hex for share keys; rate-limit guesses.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →