WP Manifestindependent plugin directory
manifest / analytics / simple-ga4-ranking

Simple GA 4 Ranking WP RegistryMedium-severity findings · 1 findingOpen the reportB #4 in Analytics & Tracking

by Digitalcube · github.com/digitalcube/simple-ga4-ranking · website

★ 9stars
1.7krelease downloads
≈130active sites
0.0.11latest · 2 years ago

Install

Download release.zip From the 0.0.11 release on GitHub, Jul 12, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/digitalcube/simple-ga4-ranking/releases/download/0.0.11/release.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/digitalcube/simple-ga4-ranking ↗

Ranking plugin using data from Google Analytics (GA4).

Description

Ranking plugin using data from Google Analytics. The feature is very lightweight because it does not save ranking data in WordPress DB.

How to use

Installation

  1. Upload simple-ga-4-ranking to the /wp-content/plugins/ directory.
  2. Activate the plugin through the 'Plugins' menu in WordPress.

Screenshots

Changelog

0.0.1

  • BETA release.

0.0.2

  • Some fix

0.0.3

  • Added fallback to composer autoloading

0.0.4

0.0.5

  • Changed to log detailed API errors only if the constant SGA4R_DETAIL_LOG is defined

0.0.6

  • Added Auto Update from GitHub

0.0.7

  • fix Auto Update from GitHub

0.0.8

  • fix {tax}__not_in

0.0.9

  • Added 'transient_key_suffix' parameter

0.0.10

  • Tested: WordPress 6.6
  • Merged: If the date cannot be obtained with wp_date, start_date and end_date must be specified by @shiro96
  • Merged: Allow specifying post type when in debug mode by @Shizumi

0.0.11

  • Added Admin screen for cache list

Releases

9 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.0.11 latest
Jul 12, 2024 2 years ago
release.zip
521
0.0.10
Jul 1, 2024 2 years ago
release.zip
132
0.0.9
Nov 28, 2023 2 years ago
release.zip
305
0.0.8
Jul 21, 2023 3 years ago
release.zip
312
0.0.7
Jun 28, 2023 3 years ago
release.zip
96
0.0.4
May 30, 2023 3 years ago
release.zip
122
0.0.3
Apr 3, 2023 3 years ago
release.zip
85
0.0.2
Aug 10, 2022 4 years ago
release.zip
142
0.0.1
Aug 10, 2022 4 years ago
release.zip
15

Active-site estimate ≈130 comes from the median of recent superseded releases. Method.

B grade

Security

Simple GA 4 Ranking 0.0.11 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.0.11
Findings
1
Worst severity
medium
Content hash
e833711a2e63cfae021ce6c3…

Findings

  • medium CSRF disconnects Google Analytics OAuth before state is validated

    csrf

    OAuth Admin::admin_init() runs on wp-admin/options-general.php?page=gapiwp-analytics. The POST Authorization button is nonce-gated (sga4ranking_ga_auth), but is_auth_callback_request() treats any GET that includes non-empty page, state, code, and scope as a Google redirect and sets $do_auth with no nonce and no current_user_can in the handler. Auth::authorize() then delete_transient(ACCESS_TOKEN_TRANSIENT_KEY) and delete_option(REFRESH_TOKEN_OPTION_KEY) *before* get_auth_code() compares $_SESSION['oauth_state'] to GET state; a mismatch only later wp_die('Bad Request'). WordPress menu.php already 403s roles below manage_options, so Subscriber/customer cannot hit this, but SameSite=Lax still sends auth cookies on a top-level GET. A logged-in administrator who clicks https://site/wp-admin/options-general.php?page=gapiwp-analytics&state=x&code=y&scope=z loses the stored Google refresh token. Ranking fetch (Analytics::create_credentials / fetch) then fails until the admin re-runs Google Authorization. This is not OAuth-token hijack (state still blocks exchanging an attacker code) — it is a one-click disconnect of the site's GA connection.

    includes/Admin/OAuth/Admin.php:14-48

    Recommendation

    Do not delete the refresh/access tokens until the OAuth state matches the value stored for this session (and, for the button POST, the existing nonce). Add current_user_can('manage_options') inside admin_init before authorize(). Keep token deletion on an explicit, nonce-protected 'Disconnect' action rather than on every callback attempt. Use a 302 redirect after auth, not 301.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →