WP Manifestindependent plugin directory
manifest / users / pmpro-default-level

PMPro Default Post Membership Level WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

A WordPress plugin for setting the default PMPro membership level for new posts of any post type.

★ 1stars
v0.6latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/carimus/pmpro-default-level/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
PMPro Default Level A WordPress plugin and addon for Paid Memberships Pro that allows you to set the default PMPro level requirements for new pages, posts, or any custom post type. Features - Set the default level per post type (i.e. different post types can have different defaults) - Easily copy settings from and to post types if you have a lot of them - Reset level requirements for an existing post to the configured defaults. - Reset level requirements for new post to the configured defaults after changing but before saving. - Tools to reset all existing posts en masse to their configured default access levels (optionally filtered by post type). - Set WPDEBUG to true for debug output on the "PMPro Default Levels" settings page. Prerequisites - PHP 5.4+ - The paid-memberships-pro WP plugin must be installed and activated. - Tested with versions 1.8.5.6 and 1.9.5.4. Should work with all recent versions. - The pmpro-cpt paid PMPro add-on must be installed and activated if you want to set the default access level for custom post types as well. Caveats - Only effects new posts created via the editor in the WP backend. I.e. does not affect posts created

Releases

4 releases.

Tag
Published
v0.6 latest
Sep 26, 2018 8 years ago
Sep 26, 2018 8 years ago
Sep 26, 2018 8 years ago
Sep 26, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

PMPro Default Post Membership Level 0.6 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.6
Findings
1
Worst severity
medium
Content hash
7bc2535cd03f59c2d7c2a52b…

Findings

  • medium Reflected XSS in PMPro default-level tools notice

    xss_reflected

    The tools section echoes $_GET['pmdef_tools_message'] and $_GET['pmdef_tools_message_type'] without escaping. An attacker who tricks an admin into opening a crafted admin URL (page=pmdef...) can execute script in the admin origin.

    pmpro-default-level.php:281-288

    Recommendation

    Use esc_html() / sanitize_html_class() (or store the notice in a transient) instead of echoing raw query args.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.