WP Manifestindependent plugin directory
manifest / multisite / tms-plugin-network-site-list

TMS Network Site List WP RegistryMedium-severity findings · 1 findingOpen the reportB

Provides a REST endpoint that lists the sites in a network installation.

by Geniem Oy · github.com/devgeniem/tms-plugin-network-site-list · website

★ 2stars
2.2kcomposer installs
1.2.0latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/devgeniem/tms-plugin-network-site-list/archive/refs/heads/master.zip

On Packagist as devgeniem/tms-plugin-network-site-list:

composer require devgeniem/tms-plugin-network-site-list
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/devgeniem/tms-plugin-network-site-list ↗

TMS (Tampere Multisite) WordPress Plugin Network Site List

WordPress plugin for that provides a REST endpoint for listing all sites in a network installation.

Prerequisites

  • WordPress Network installation

Routes

Route /wp-json/tms/sites/ returns site list as an array.

[
    [
        'ID' => 1,
        'name' => 'foo',
    ],
    [
        'ID' => 2,
        'name' => 'bar',
    ],
    [
        'ID' => 3,
        'name' => 'baz',
    ],
]

Contributing

Contributions are highly welcome! Just leave a pull request of your awesome well-written must-have feature.

Releases

4 releases.

Tag
Published
1.2.0 latest
Jun 1, 2023 3 years ago
1.1.0
Apr 11, 2023 3 years ago
1.0.0
Aug 23, 2022 4 years ago
0.0.2
Aug 23, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

TMS Network Site List 1.2.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.2.0
Findings
1
Worst severity
medium
Content hash
055ee98e0de719b5d878b750…

Findings

  • medium Unauthenticated REST endpoint enumerates all multisite sites

    information_disclosure

    register_rest_route namespace tms path sites uses permission_callback __return_true and returns get_sites() mapped to ID and name for every site. Unauthenticated clients can enumerate the network. The plugin also remove_filter('rest_authentication_errors', 'v_forcelogin_rest_access', 99), weakening Force Login protections for REST.

    src/NetworkSiteListPlugin.php:99-146

    Recommendation

    Restrict the route with a capability or application password; avoid globally removing Force Login REST filters—scope exceptions to this route only if needed.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →