WP Manifestindependent plugin directory
manifest / multisite / mainwp-cribops-extension

MainWP CribOps Extension WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

MainWP extension for managing CribOps WP Kit across multiple WordPress sites

★ 0stars
12release downloads
v1.4.7latest · 1 year ago

Install

Download mainwp-cribops-extension.zip From the v1.4.7 release on GitHub, Oct 8, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cloudbedrock/mainwp-cribops-extension/releases/download/v1.4.7/mainwp-cribops-extension.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

A MainWP Extension that enables centralized control and management of CribOps WP Kit across multiple WordPress sites.

Overview

This extension allows MainWP dashboard administrators to:

  • Monitor CribOps WP Kit installation status across all child sites
  • Trigger bulk plugin installations using predefined recipes
  • Manage premium plugin licenses centrally
  • Synchronize CribOps WP Kit settings across sites
  • View installation logs and activity reports

Requirements

Dashboard Site (MainWP Server)

  • WordPress 5.0 or higher
  • PHP 7.4 or higher
  • MainWP Dashboard plugin (latest version)
  • This MainWP CribOps Extension

Child Sites

  • WordPress 5.0 or higher
  • PHP 7.4 or higher
  • MainWP Child plugin (latest version)
  • CribOps WP Kit with MainWP integration (v1.1.3+)

Installation

Step 1: Install on MainWP Dashboard

  1. Upload the mainwp-cribops-extension folder to /wp-content/plugins/
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Navigate to MainWP → CribOps WP Kit

Step 2: Prepare Child Sites

  1. Ensure MainWP Child plugin is installed and connected
  2. Install CribOps WP Kit (with MainWP integration support)
  3. The integration will automatically activate when both plugins are present

Features

Site Status Monitoring

  • Real-time status of CribOps WP Kit on all child sites
  • Version tracking
  • Authentication status
  • Settings overview

Bulk Plugin Installation

Pre-configured recipes:

  • Essential Plugins: Classic Editor, Duplicate Post, Regenerate Thumbnails, WP Mail SMTP
  • Security Suite: Wordfence, Limit Login Attempts, WP Force SSL
  • Performance Pack: WP Super Cache, Autoptimize, WP Sweep
  • E-commerce Bundle: WooCommerce and related plugins

License Management

  • Centrally manage premium plugin licenses
  • Push license keys to all child sites
  • Support for major premium plugins (ACF Pro, Gravity Forms, etc.)

Settings Synchronization

  • Push CribOps WP Kit settings to multiple sites
  • Bulk configuration updates
  • Template-based settings management

Available Remote Functions

The following functions can be called on child sites:

  • cribops_get_status: Get plugin status and configuration
  • cribops_get_settings: Retrieve current settings
  • cribops_update_settings: Update plugin settings
  • cribops_install_plugins: Install plugin recipes
  • cribops_get_installed_plugins: List installed plugins
  • cribops_manage_licenses: Manage license keys
  • cribops_get_logs: Retrieve activity logs
  • cribops_run_bulk_install: Execute bulk installations
  • cribops_sync: Synchronize with dashboard

API Integration

The extension communicates with child sites using MainWP's secure API:

  • Authentication via MainWP signatures
  • HTTPS encrypted communication
  • WordPress nonce verification
  • Capability checks on both sides

Development

File Structure

mainwp-cribops-extension/
├── mainwp-cribops-extension.php    # Main plugin file
├── class-mainwp-cribops-extension.php  # Extension class
├── assets/
│   ├── admin.js                    # Admin JavaScript
│   └── admin.css                   # Admin styles
└── README.md                        # This file

Hooks and Filters

Dashboard Hooks

  • mainwp_getextensions: Register the extension
  • mainwp_sync_others_data: Add custom sync data
  • mainwp_site_synced: Handle post-sync actions

Child Site Hooks

  • mainwp_child_extra_execution: Handle dashboard requests
  • mainwp_site_sync_others_data: Add data to sync
  • mainwp_child_callable_functions: Register functions

Testing

Basic Communication Test

  1. Dashboard Side:

    • Navigate to MainWP → CribOps WP Kit
    • Click "Sync All Sites"
    • Verify site status updates
  2. Child Site Verification:

    • Check if CribOps WP Kit shows MainWP integration active
    • Review activity logs for MainWP requests

Installation Test

  1. Select a test recipe (e.g., Essential Plugins)
  2. Click "Install on All Sites"
  3. Monitor progress in the dashboard
  4. Verify installations on child sites

Troubleshooting

Extension Not Appearing in MainWP

  • Verify MainWP Dashboard is active
  • Check PHP error logs
  • Ensure proper file permissions

Child Sites Not Responding

  • Verify MainWP Child is installed and connected
  • Check CribOps WP Kit has MainWP integration loaded
  • Review child site error logs

Installation Failures

  • Verify authentication credentials
  • Check API endpoint availability
  • Ensure sufficient server resources

Support

For issues or questions:

License

GPL v2 or later

Credits

Developed by CribOps Development Team Based on MainWP Extension architecture

Releases

18 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.4.7 latest
Oct 8, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
4
mainwp-cribops-extension.zip3
mainwp-cribops-extension-v1.4.7.zip1
Oct 8, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.4.6.zip1
Oct 8, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.4.5.zip1
Oct 7, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.4.4.zip1
Oct 7, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.4.3.zip1
Oct 7, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.4.2.zip1
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.4.1.zip1
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.4.0.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.2.3.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.3.1.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.2.2.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.3.0.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.2.1.zip1
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.2.0.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.1.1.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.1.0.zip0
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
1
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.0.2.zip1
Oct 6, 2025 1 year ago
mainwp-cribops-extension.zip +1 asset
0
mainwp-cribops-extension.zip0
mainwp-cribops-extension-v1.0.1.zip0
D+ grade

Security

MainWP CribOps Extension 1.4.7 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.4.7
Findings
2
Worst severity
high
Content hash
b0f94ae40a27eb402d78770d…

Findings

  • high Nonce-only AJAX runs authed extra_execution on MainWP child sites

    missing_capability

    ajax_run_action verifies nonce mainwp-cribops-nonce then calls MainWP_Connect::fetch_url_authed($website, 'extra_execution', {action: 'cribops_'.$action, args}) with attacker-chosen site_id, action_type, and unsanitized args. There is no current_user_can or mainwp_current_user_have_right in the handler. wp_ajax_ admits any logged-in user; WordPress nonces are per-user, so a Subscriber can mint a valid nonce for this action without visiting the MainWP UI. That is remote plugin/license control of child sites.

    class-mainwp-cribops-extension-activator.php:376-408

    Recommendation

    Require current_user_can('manage_options') or mainwp_current_user_have_right('extension', 'mainwp-cribops-extension') at the start of every ajax_* handler. Allowlist action_type. Sanitize args.

  • high Nonce-only AJAX lists all MainWP child site URLs

    missing_capability

    ajax_get_sites is the same pattern: nonce only, then MainWP_DB::get_websites_by_user_id(1) and returns id/name/url plus cribops status. A logged-in low-priv user learns the full child fleet.

    class-mainwp-cribops-extension-activator.php:260-270

    Recommendation

    Same capability gate as the run_action handler. Query sites for the current user, not hard-coded user id 1.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.