WP Manifestindependent plugin directory
manifest / updates / wp-juggler-client

WP Juggler Client WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

WP Juggler Client: WordPress plugin - client component of WP Juggler - robust, free, open-source WordPress Management System which allows you to command and control unlimited number of WordPress sites through a single, self-hosted control panel.

★ 1stars
100release downloads
≈10active sites
1.1.4latest · 2 years ago

Install

Download wp-juggler-client.zip From the 1.1.4 release on GitHub, Oct 17, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/boldthemes/wp-juggler-client/releases/download/1.1.4/wp-juggler-client.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

[!IMPORTANT] This repository hosts WP Juggler Client plugin. For WP Juggler Getting Started Guide or WP Juggler Server plugin, visit this repository: WP Juggler Server plugin

WP Juggler is your ultimate solution for effectively managing an unlimited portfolio of WordPress sites from a single, intuitive dashboard.

WP Juggler helps you to enhance your operational efficiency, ensure your sites stay current with updates, and reclaim precious time to focus on more impactful projects.

Being an open-source and completely free tool, WP Juggler is designed to revolutionize your WordPress maintenance experience without costing you a dime.

How does it work - Main concepts

WP Juggler has two components:

Network setup - as easy as one, two, three

You can setup your WP Juggler Network in three simple steps:

  1. Kickstart the process by installing the WP Juggler Server plugin on one of your WordPress sites
  2. Install WP Juggler Client plugins on sites you want to control and manage
  3. Register and activate your sites on your server with a single mouse click

Complete User Documentation

You can find the complete User Documentation on this link: https://documentation.bold-themes.com/wp-juggler/ but you can also find the Getting Started intructions below.

Getting Started Guide

Install plugins

  1. Download wp-juggler-server.zip file from the latest release of WP Juggler Server plugin.
  2. Install and Activate WP Juggler Server plugin on one of your WordPress sites. This site will serve as your control panel.
  3. Download wp-juggler-client.zip file from the latest release of WP Juggler Client plugin.
  4. Install and Activate WP Juggler Client plugin on WordPress sites you want to monitor and manage remotely.

Add new site

  1. Navigate to WP Juggler > Sites in your server's wp-admin and click Add New
  2. Enter the site name as title, enter the site url.
  3. Click Assign Users and add the users who will be able to manage the added site (add your user for start).
  4. Click Save and copy API Key to clipboard

Activate new site

  1. Navigate to WP Juggler screen in your client site's wp-admin and enter bith API Key and server's url
  2. Click Save Settings. You will should see the message that your site is successfully activated
  3. If the activation fails and the Auth Header Test Row also says "Failed", do as instructed in the section Enable PHP HTTP Authorization Header

Screenshot of WP Juggler Site Edit Screen

Fetch your first data

  1. Navigate to WP Juggler > Control Panel in your server's wp-admin and your newly activated site should appear in the list.
  2. Click the arrow at the end of its row to expand the panel and click Refresh All Site Data
  3. Once the refresh finishes you will be able to see the summary of the data retrieved from your site.
  4. Explore the available info by clicking buttons in the expansion panel

Enable one-click login to wp-admin

  1. Navigate to WP Juggler > Sites in your server's wp-admin and edit the desired site.
  2. Check Automatic Login, enter Remote Login Username (username of the user you are going to log in on the target site) and click Save
  3. On your client site, edit the User's profile and check Enable auto login for this user.
  4. We are all set. You can test the login by first logging out of the client site's wp-admin.
  5. Lastly, go to your control panel and click wp-admin button in your site's row. You should be automatically logged in as chosen user.

Enable PHP HTTP Authorization Header

[!Note] This section describes the actions that need to be taken if the Auth Header Test says Failed either on Server or Client side

Shared Hosts

Most shared hosts have disabled the HTTP Authorization Header by default.

To enable this option you'll need to edit your .htaccess file by adding the following:

RewriteCond %{HTTP:Authorization} ^(.*)
RewriteRule ^(.*) - [E=HTTP_AUTHORIZATION:%1]

just after

RewriteEngine on

WPEngine

To enable this option you'll need to edit your .htaccess file by adding the following (see #1):

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

ToDo List

If you have a feature proposal or an idea on how to make WP Juggler better and more useful, please use Issues section. We will be glad to review them and add them to the list.

Releases

13 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.4 latest
Oct 17, 2024 2 years ago
wp-juggler-client.zip
26
Oct 17, 2024 2 years ago
wp-juggler-client.zip
5
Oct 15, 2024 2 years ago
wp-juggler-client.zip
5
Oct 8, 2024 2 years ago
wp-juggler-client.zip
7
Oct 7, 2024 2 years ago
wp-juggler-client.zip
8
Oct 2, 2024 2 years ago
wp-juggler-client.zip
6
Sep 30, 2024 2 years ago
wp-juggler-client.zip
12
Sep 18, 2024 2 years ago
wp-juggler-client.zip
9
Sep 17, 2024 2 years ago
wp-juggler-client.zip
4
Sep 17, 2024 2 years ago
wp-juggler-client.zip
5
Sep 17, 2024 2 years ago
wp-juggler-client.zip
5
Sep 17, 2024 2 years ago
wp-juggler-client.zip
4
Sep 16, 2024 2 years ago
wp-juggler-client.zip
4

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

WP Juggler Client 1.1.4 · audited by WP Registry

Medium-severity findings.

2 medium
Audited release
1.1.4
Findings
2
Worst severity
medium
Content hash
1ce8c5b02a5eb971f2c21c88…

Findings

  • medium Control-plane HTTP client disables TLS verification and unsafe-URL rejection

    insecure_config

    WPJC_Server_Api::call_server_api() POSTs JSON to {wpjc_server_url}/wp-json/juggler/v1/{endpoint} with Authorization: Bearer {wpjc_api_key} and sslverify => false (commented 'TODO SHOULD BE REMOVED FOR PRODUCTION'). The same key is the HMAC secret for auto-login JWTs and the gate for installPlugin/activatePlugin/updatePlugin. A second hook, WPJC_Plugin_Updater::bypass_verification_for_updater on http_request_args, sets sslverify false and reject_unsafe_urls false for any request URL that strpos-matches the configured server URL (not a parsed-host prefix check). Those requests include the unauthenticated GET {server}/wpjs-plugins/ JSON whose download_url values are written into site_transient_update_plugins as package URLs. Observable consequence: an on-path attacker can read the API key from the activateSite request and/or replace plugin zip packages the site will install on the next update, which is RCE. Requires a network MITM relative to the configured server, so this is not unauthenticated-from-the-internet on its own.

    includes/class-wpjc-server-api.php:84-92

    Recommendation

    Remove sslverify => false and reject_unsafe_urls => false. Verify TLS with the system CA store. Match the update-server host with wp_parse_url() (scheme+host), not strpos. Send the API key only over verified HTTPS.

  • medium Auto-login endpoint open-redirects via unsanitized wpjs_redirect

    unsafe_input

    template_redirect handler WPJC_Service::wpjc_check_token() activates on any request whose path ends with /wpjs/. It reads $_GET['wpjs_redirect'] through sanitize_text_field (which does not restrict to local URLs) and passes it to wp_redirect() rather than wp_safe_redirect(). If the visitor is already logged in, the JWT in wpjs_token is never validated — any logged-in user who visits /wpjs/?wpjs_token=x&wpjs_redirect=https://evil.example is sent off-site. After a valid JWT login the same unsanitized parameter is used, so a leaked or phished token URL can be rewritten to an attacker origin (Referer may also replay the token). Observable consequence: phishing/open-redirect against authenticated users, including administrators, with no capability check.

    includes/class-wpjc-service.php:97-147

    Recommendation

    Always validate the JWT before redirecting. Use wp_safe_redirect() (or an allow-list of admin_url()/home_url() paths) for wpjs_redirect. Do not honor an absolute external URL.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.