WP Manifestindependent plugin directory
manifest / developer / carbonwordpress

CarbonWordPress WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

Wordpress bindings and GUI for CarbonPHP. A wordpress Plugin.

by Richard Tyler Miles · github.com/carbonorm/carbonwordpress · website

★ 0stars
110composer installs
1.2.0latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/carbonorm/carbonwordpress/archive/refs/heads/main.zip

On Packagist as carbonorm/carbonwordpress:

composer require carbonorm/carbonwordpress
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/carbonorm/carbonwordpress ↗
CarbonWordpress A WordPress Plugin to provide a GUI for CarbonPHP. Currently our GUI supports: 1) Migrating data between servers 2) Starting a WebSocket and viewing the realtime logs 3) Updating composer Download Options This is a general list of different ways to download the CarbonPHP framework. I've ordered them from IMO least technical to most technical. 1) ~~Search for CarbonPHP in the WordPress plugin store.~~ (Pending review) 2) Download the latest stable code directly as a zip from GitHub. - Log in to your WordPress account. - In the left-side menu, navigate to "Plugins" and click on it. - Choose the "Add New" option. - Click on the "Upload Plugin" button. - Select the "Choose File" button. - Locate and pick the plugin's .zip file stored on your local computer. - Click "Open." - To commence the installation, click on "Install Now." 3) Install the plugin using Composer. - Open a terminal and navigate to your WordPress installation. - Run the following command to install the plugin. - Log in to your WordPress admin dashboard. - In the left-hand menu, click on "Plugins." - You will see a list of all your install

Releases

11 releases.

Tag
Published
1.2.0 latest
Apr 12, 2024 2 years ago
1.1.10
Apr 11, 2024 2 years ago
1.1.9
Apr 11, 2024 2 years ago
1.1.8
Mar 30, 2024 2 years ago
1.1.7
Mar 30, 2024 2 years ago
1.1.6
Mar 18, 2024 2 years ago
1.1.5
Mar 18, 2024 2 years ago
1.1.4
Mar 18, 2024 2 years ago
1.1.3
Mar 14, 2024 2 years ago
1.1.2
Mar 14, 2024 2 years ago
1.1.0
Mar 14, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

CarbonWordPress 1.2.0 · audited by WP Registry

High-severity findings.

1 high 2 medium
Audited release
1.2.0
Findings
3
Worst severity
high
Content hash
27e5eb300c30273c271fd368…

Findings

  • high Author/editor privilege can run shell_exec and write license PHP under ABSPATH

    missing_capability

    CarbonWordPress::isPrivilegedUser() returns true for author and editor. WordPressApplication routes under c6wordpress/logs/* and c6wordpress/logs/composer/update execute shell_exec/Background commands. migrate/addLicense writes ABSPATH/CarbonWordPressLicense.php with unsanitized $_POST['license'] interpolated into PHP source.

    carbonwordpress/CarbonWordPress.php:91-98

    Recommendation

    Restrict privileged routes to manage_options (or a dedicated capability). Never interpolate user input into PHP files; store license as an option or validated token. Avoid shell_exec from web requests.

  • medium License acceptance via GET without nonce or capability

    csrf

    On init, if $_GET[page]=CarbonORM and $_GET[action]=acceptLicense, the plugin writes licenseAccepted with no nonce or current_user_can check (only that the request hits this code path while plugin is loaded).

    carbonwordpress.php:39-48

    Recommendation

    Require manage_options, POST + nonce, before writing consent file.

  • medium shell_exec used during plugin bootstrap for Composer install

    rce

    carbonwordpress.php invokes shell_exec to locate/install Composer and run composer install under web request context when autoload is missing — large attack surface and unexpected host modification.

    carbonwordpress.php:115-132

    Recommendation

    Do not auto-install Composer from web requests; require CLI/admin-approved setup with no remote pipe-to-php.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →