WP Manifestindependent plugin directory
manifest / integrations / telegram-notifier

Telegram Notifier WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Wordpress plugin for sending notifications about GravityForms submitting to telegram

by Drozzi Pro · github.com/drozzi-pro/telegram-notifier

★ 0stars
34composer installs
1.0.4latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/drozzi-pro/telegram-notifier/archive/refs/heads/master.zip

On Packagist as drozzi-pro/telegram-notifier:

composer require drozzi-pro/telegram-notifier
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/drozzi-pro/telegram-notifier ↗
Telegram Notifier Плагин для Wordpress, который через бота отсылает уведомления об подтверждении выбранных вами GravityForms форм конеретным пользователям бота. Плагин не имеет внутренних зависимостей. Необходимо только то, чтобы в окружении был установлен плагин GravityForms.

Releases

5 releases.

Tag
Published
1.0.4 latest
Jan 9, 2024 2 years ago
1.0.3
Nov 11, 2023 2 years ago
1.0.2
Aug 14, 2023 3 years ago
1.0.1
Jul 7, 2023 3 years ago
1.0.0
Jul 7, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Telegram Notifier 1.0.0 · audited by WP Registry

High-severity findings.

1 high 1 low
Audited release
1.0.0
Findings
2
Worst severity
high
Content hash
651a5245064d25e8d37d6825…

Findings

  • high Admin actions lack nonce and capability checks

    missing_auth

    set_actions_handlers registers admin_action_telegram-notifier-* callbacks that run action_handler_wrapper with no current_user_can or nonce verification. Any authenticated user can add/remove mailing-list users, sync Telegram updates, or modify gf_list options via admin.php?action=...

    telegram-notifier.php:411-542

    Recommendation

    Require current_user_can('manage_options') and check_admin_referer before mutating state; reject missing nonces.

  • low Version mismatch between slug and header

    version_mismatch

    Slug indicates 1.0.4 but plugin header/hashes version is 1.0.0.

    telegram-notifier.php:1-20

    Recommendation

    Align Version header with release tag.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →