WP Manifestindependent plugin directory
manifest / i18n / wpml-cloudinary

WPML Cloudinary WP RegistryMedium-severity findings · 1 findingOpen the reportB

Multilingual support for the Cloudinary WordPress plugin

by Clarify · github.com/clarifynl/wpml-cloudinary · website

★ 0stars
1.1.1latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/clarifynl/wpml-cloudinary/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Releases

3 releases.

Tag
Published
1.1.1 latest
Apr 3, 2023 3 years ago
1.1.0
Apr 25, 2022 4 years ago
1.0.0
Nov 19, 2021 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WPML Cloudinary 1.1.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.1
Findings
1
Worst severity
medium
Content hash
b987c7f4829e0eecd13ba77e…

Findings

  • medium Unauthed-beyond-login WPML Cloudinary fix_* AJAX lacks capability/nonce

    wp_ajax_fix_missing_file_paths, fix_missing_cloudinary_meta, and fix_incorrect_wordpress_meta have no current_user_can or check_ajax_referer. Any logged-in user can trigger bulk update_post_meta on attachment translations (_wp_attached_file, Cloudinary meta, _wp_attachment_metadata), altering media library state.

    admin/class-wpml-cloudinary-admin.php:139-170

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →