WP Manifestindependent plugin directory
manifest / ecommerce / d-plugin-fulcrum

Fulcrum - Helper Tool WP RegistryHigh-severity findings · 1 findingOpen the reportC-

by Chris "Duffs" Crevling · github.com/duffion/d-plugin-fulcrum · website

★ 0stars
0.9.7latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/duffion/d-plugin-fulcrum/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/duffion/d-plugin-fulcrum ↗
Duffion WP Plugin - Custom Project - Fulcrum POS Required Plugins - Woocommerce (current tested) Installation Instructions Development Instructions Style / script development uses GULP for compiling. NPM Requirements - NPM Ver 14+ - npm install --global gulp-cli Scripts npm run -- Runs default gulp command gulp dev -- clear | build | watch npm run dev -- Runs gulp dev gulp clear -- clear built assets gulp sass -- rebuild just sass gulp images -- rebuild images gulp js -- rebuild javascript gulp build -- production build NOTE - IMPORTANT If you are installing this via GIT repo and not the zip you will NEED to make sure to take your terminal to the plugin dir you cloned down then make sure to run gulp build or just keep a gulp dev active as this will also build and this will watch your assets/src directory for anything to compile.

Releases

10 releases.

Tag
Published
0.9.7.2
Aug 17, 2021 5 years ago
0.9.7.1
Aug 11, 2021 5 years ago
0.9.7 latest
Aug 11, 2021 5 years ago
0.9.6
Aug 11, 2021 5 years ago
0.9.5
Aug 11, 2021 5 years ago
0.9.4
Aug 11, 2021 5 years ago
0.9.3
Aug 11, 2021 5 years ago
0.9.2
Aug 11, 2021 5 years ago
0.9.1
Aug 11, 2021 5 years ago
0.9.0
Aug 11, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Fulcrum - Helper Tool 0.9.6 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.9.6
Findings
1
Worst severity
high
Content hash
3fca4478fc68342d18ea798c…

Findings

  • high Product Category Scraper AJAX uses is_admin() instead of capability checks

    missing_auth

    pcs_add_job, pcs_remove_job, and pcs_run_jobs are registered as wp_ajax_nopriv_*. ajax__add_job/ajax__remove_job gate on is_admin(), which is TRUE for all admin-ajax.php requests including unauthenticated ones. Unauth callers can update_option('fulcrum__pcs_jobs') and ajax__run_jobs only requires POST time>0 with no auth at all, triggering product taxonomy mutation via process_job.

    inc/modules/product-category-scraper.php:31-160

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →