WP Manifestindependent plugin directory
manifest / utilities / wp-plugin-epfl-coming-soon

EPFL Coming Soon WP RegistryMedium-severity findings · 1 findingOpen the reportB

Basic WordPress plugin that allows to display a coming soon / maintenance page. Rest API status + wp cli maintenance-mode.

by EPFL IDEV-FSD · github.com/epfl-si/wp-plugin-epfl-coming-soon · website

★ 1stars
68release downloads
≈10active sites
v0.1.7latest · 3 years ago

Install

Download epfl-coming-soon.zip From the v0.1.7 release on GitHub, Feb 27, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/epfl-si/wp-plugin-epfl-coming-soon/releases/download/v0.1.7/epfl-coming-soon.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/epfl-si/wp-plugin-epfl-coming-soon ↗

A WordPress plugin that allows to display a coming soon / maintenance page.

Get the latest version

Download the latest release at https://github.com/epfl-si/wp-plugin-epfl-coming-soon/releases/latest.

Features

  • Simple ON / OFF mode
  • Edit coming soon page in the wordpress WYSIWYG editor (TinyMCE)
  • Edit the page's title
  • Option to redirect on the theme maintenance.php page if present (has to be self-contained for now)
  • Option to send a HTTP status code 503 along with the page
  • Auto-activated if the .maintenance file is present (see https://developer.wordpress.org/cli/commands/maintenance-mode/), i.e. wp cli maintenance-mode activate : wp cli compatible
  • Shows its status in the rest API, wp-json/epfl-coming-soon/v1/status

Screenshots

Backend

EPFL coming soon screenshot - backend

Frontend

EPFL coming soon screenshot - frontend

Development

The use of [wp-dev]() environment is highly recommended to have an environment similar to what we have in "prod" and avoid any conflicts between plugins.

Please use the Makefile to run WordPress-Core coding standards' linter.

Any commits should be accompanied with a new version following the SemVer system.

New release

  • [ ] Be sure to bump the version, both in comment and constant.
  • [ ] Run the linter with make phpcbf and make phpcs; fix all the mentionned lines.
  • [ ] Check that translations are done (make pot).
  • [ ] Use make zip to create the plugin package without unused dependencies.
  • [ ] Tag the version (git tag -fa v1.1.1 -m v1.1.1).
  • [ ] Push everything and create a new release with comments.

Issues

Feel free to share your thoughts, issues, remarks and comments here: https://github.com/epfl-si/wp-plugin-epfl-coming-soon/issues/new/choose.

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.1.7 latest
Feb 27, 2023 3 years ago
epfl-coming-soon.zip +1 asset
29
epfl-coming-soon.zip13
epfl-coming-soon-0.1.7.zip16
v0.1.6
Jun 25, 2021 5 years ago
epfl-coming-soon-0.1.6.zip
6
v0.1.3
Nov 12, 2020 5 years ago
epfl-coming-soon_v0.1.3.zip
12
v0.1.0
Nov 11, 2020 5 years ago
epfl-coming-soon_v0.1.0.zip
9
v0.0.3
Nov 2, 2020 5 years ago
epfl-coming-soon_v0.0.3.zip
12

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

EPFL Coming Soon 0.1.7 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.1.7
Findings
1
Worst severity
medium
Content hash
29732b4ccb8587722d7ba95c…

Findings

  • medium Unauthenticated coming-soon/maintenance bypass via REQUEST_URI keywords and REST

    auth_bypass

    epfl_maintenance_load() is the plugin's only front-end gate. Before any status check it returns if $_SERVER['REQUEST_URI'] matches /login|admin|dashboard|account/i, intended to spare wp-login.php and wp-admin. REQUEST_URI includes the query string, so an unauthenticated visitor can open any published post, page, archive, or search by appending ?admin (or ?login, ?dashboard, ?account, or using a slug that contains those substrings). The same function also skips every request whose URI contains the REST prefix (default wp-json/), so core collections such as /wp-json/wp/v2/posts remain fully public while the overlay is armed. Observable: with Status ON (or .maintenance present), GET /?admin returns the live theme instead of the TinyMCE coming-soon template or the 'Sorry, site's not ready yet.' fallback, and GET /wp-json/wp/v2/posts JSON-lists published content the splash was meant to hide. This does not grant wp-admin, change options, or leak drafts/private posts beyond what core REST already exposes on a non-coming-soon site — it defeats the plugin's confidentiality promise. is_user_logged_in() skipping the overlay for Subscriber+ is treated as intended preview, not a finding.

    src/classes/class-epflcomingsoon.php:86-96,153-165

    Recommendation

    Allowlist exact paths (wp-login.php, wp-admin/, admin-ajax.php, admin-post.php) instead of substring-matching REQUEST_URI. Do not treat query-string tokens as login/admin. Optionally require a manage_options (or plugin-specific) capability to view the live site, rather than any logged-in user. For REST, either serve the coming-soon response on public content routes or restrict wp/v2 reads while the overlay is on, leaving only the documented epfl/v1/coming-soon status endpoint public.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →