WP Manifestindependent plugin directory
manifest / content / oer-wp-plugin

OER WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Wordpress plugin for search Open Educational Resources using FI-ADMIN API

by BIREME/OPAS/OMS · github.com/bireme/oer-wp-plugin · website

★ 0stars
1.2latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/bireme/oer-wp-plugin/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/bireme/oer-wp-plugin ↗

Open Educational Resource plugin for WordPress

Introduction

This plugin creates a search interface for the Virtual Health Library Open Educational Resource information source.

Requirements

Wordpress 4.x

Install

  1. Download the OER plugin for Wordpress;
  2. Unzip the plugin below the wp-content/plugins folder of your Wordpress instance and rename it to oer;
  3. Activate the LeisRef plugin through the administration panel of WordPress (dashboard).

For further information on installing plugins please see the Manual Plugin Installation from Wordpress codex site.

Configuration

Go to Settings in the administration panel (dashboard) and click on the newly created Open Educational Resources item.

  • Plugin page is mandatory and is set to oer by default. It defines the URL of the search interface page;
  • Filter query is optional and defines the strategy (a term or expression) to act as a filter for record displaying.
  • AddThis profile ID is optional and is provided to allow the integration with sharing tools services AddThis. Notice this requires previous registration within the sharing tools service;
  • Google Analytics code is optional and allows the integration of website analytics services provided by Google. Notice this requires previous registration in Google.

Releases

3 releases.

Tag
Published
1.2 latest
Mar 12, 2021 5 years ago
1.1.0
Nov 25, 2019 6 years ago
1.0
May 27, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

OER 0.3 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
0.3
Findings
2
Worst severity
high
Content hash
6f2bc2fd2268ae03b32f50c8…

Findings

  • high Unauthenticated SSRF via directly reachable template/similar.php / related.php

    ssrf

    OER ships template/similar.php and template/related.php that bootstrap WordPress via include wp-load.php and pass attacker-controlled $_GET[query] into file_get_contents with no allowlist. These files are linked from detail/resource templates as PLUGIN_URL/template/similar.php?query=... and are web-accessible under wp-content/plugins without auth. Allows server-side fetch of internal HTTP endpoints or local files (depending on allow_url_fopen/wrappers) and response parsing into the page.

    template/similar.php:1-8

  • medium Unescaped remote XML titles echoed (XSS after SSRF)

    xss_reflected

    Titles from the fetched XML (ti / ti_*) and lang path segments are echoed without esc_html. An attacker who points query at a host they control can return XML that injects HTML/JS into the response.

    template/similar.php:20-40

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →