WP Manifestindependent plugin directory
manifest / integrations / musicwhore-artist-connector-for-wordpress

Musicwhore.org Artist Connector WP RegistryMedium-severity findings · 3 findingsOpen the reportB- Bitbucket

This custom plugin connects the Musicwhore.org artist directory with content imported from Movable Type

by Greg Bueno · bitbucket.org/nemesisvex/musicwhore-artist-connector-for-wordpress · website

★ 0stars
2.0.5latest · never

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from Bitbucket with WP-CLI:

wp plugin install https://bitbucket.org/nemesisvex/musicwhore-artist-connector-for-wordpress/get/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme bitbucket.org/nemesisvex/musicwhore-artist-connector-for-wordpress ↗

Overview

Musicwhore.org Artist Connector connects the Musicwhore.org artist database with content imported from Movable Type.

This plugin powers the artist directory featured in the Musicwhore.org Archive.

Musicwhore.org Artist Connector queries the Musicwhore.org artist, which is then displayed in the Musicwhore.org Archive theme.

Installation

Install the plugin directory under wp-content/plugins or wp-content/mu-plugins.

Configuration

After installation, go to Settings / Musicwhore Artist Connector and fill in the fields to connect to the Observant Records database.

  • Database host: The name where the Observant Records database is hosted.
  • Database name: The name of the Observant Records database on the server.
  • Database user: The name of a user with credentials to read to the Observant Records database.
  • Database password: The password of the user.

Fill in additional fields for connecting to the Amazon Product Marketing API.

  • Access key: Your Amazon Web Services Access Key.
  • Affiliate ID: Enter your affiliate IDs for the US, UK and Japan.

For queries to the Amazon Product Marketing API to work, you must define a constant named MUSICWHORE_AWS_SECRET_KEY with your Amazon Web Servers Secret Key in wp-config.php.

define( MUSICWHORE_AWS_SECRET_KEY, 'Amazon secret key goes here');

Usage

After the plugin has been enabled and a database connection stored, the Musicwhore.org Artist Connector adds a section in your post editing screen for providing Musicwhore.org Artist meta data.

Releases

21 releases.

Tag
Published
2.0.5 latest
never
2.0.4
never
2.0.3
never
2.0.2
never
2.0.1
never
2.0
never
1.3.2
never
1.3.1
never
1.3
never
1.2.2
never
1.2.1
never
1.2
never
1.1.3
never
1.1.2
never
1.1.1
never
1.1
never
1.0.2
never
1.0.1
never
1.0
never
0.02
never
0.01
never

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B- grade

Security

Musicwhore.org Artist Connector 2.0 · audited by WP Registry

Medium-severity findings.

3 medium
Audited release
2.0
Findings
3
Worst severity
medium
Content hash
cba510e70f9c32e12c5df62b…

Findings

  • medium AJAX getArtistAlbums/getAlbumReleases missing capability and nonce

    missing_capability

    wp_ajax_getArtistAlbums and wp_ajax_getAlbumReleases are registered for any authenticated user. Handlers read raw $_POST IDs, query the Musicwhore artist DB driver, and echo JSON with no current_user_can() and no check_ajax_referer(). The companion meta box UI gates on edit_posts, but the AJAX endpoints do not. Any Subscriber can enumerate albums/releases; CSRF from another origin can force a logged-in user to trigger the same reads.

    lib/PostMeta.php:30-108

  • medium AJAX handlers missing nonce (CSRF)

    missing_nonce

    Same handlers omit check_ajax_referer / wp_verify_nonce. A cross-site POST as a logged-in user can invoke the actions.

    lib/PostMeta.php:75-108

  • medium save_post meta update lacks nonce and capability check

    missing_nonce

    savePostMeta hooks save_post and writes _mw_artist_id/_mw_album_id/_mw_release_id from $_POST with no wp_verify_nonce, no current_user_can('edit_post'), and no autosave/revision guards. Classic meta-box CSRF: a crafted post save can alter Musicwhore linkage for posts the victim can edit.

    lib/PostMeta.php:111-119

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →