WP Manifestindependent plugin directory
manifest / ai / dcio-wp-pinecone-export

heise I/O Export WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Wordpress Plugin for Pinecone Export

by Sebastian Seypt · github.com/deep-content/dcio-wp-pinecone-export

★ 0stars
v1.1latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/deep-content/dcio-wp-pinecone-export/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/deep-content/dcio-wp-pinecone-export ↗

Wordpress plugin that stores newly created or updated articles in a pinecone vector databases. Articles whose status changes to not published are automatically deleted from pinecone storage by the plugin.

Settings:

image

Export of all articles to the vector database is possible as a batch process via the WP-CLI with the command:

wp heise-io export

Only articles that are not excluded and have not yet been exported are exported.

Releases

2 releases.

Tag
Published
v1.1 latest
Oct 13, 2025 1 year ago
v1.0
Oct 8, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

heise I/O Export 1.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0
Findings
1
Worst severity
high
Content hash
bb0841775a5414a83b0a18d5…

Findings

  • high Missing auth/nonce on wp_ajax_dcio Pinecone export/delete handler

    ajax_upload_delete_blob is registered as wp_ajax_dcio with no current_user_can and no nonce. Any authenticated user can POST post_id + pinecone_action (add|delete|exclude-on|exclude-off) to sync/delete content in Pinecone and update exclude_pinecone_export post meta. Admin UI is manage_options-only but the AJAX gate is missing.

    dcio-wp-pinecone-export.php:93, ajax_upload_delete_blob

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →