WP Manifestindependent plugin directory
manifest / content / wp-museum

Museum for WordPress WP Registry grade A-. Low-severity findings · 2 findingsWP RegistryLow-severity findings · 2 findingsOpen the reportA-

Wordpress plugin for operating an online museum.

★ 2stars
179release downloads
v0.9.0latest · 5mo ago

Install

Download wp-museum.zip From the v0.9.0 release on GitHub, Jun 3, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/epistemic-technology/wp-museum/releases/download/v0.9.0/wp-museum.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Museum for WordPress is a WordPress plugin that facilitates the operation of an online museum. It is a full-featured museum management system that is tightly integrated into the powerful and user-friendly WordPress software. It is desiged to operate seamlessly with any WordPress theme, while also giving administrators and authors full power to customize the appearance of museum objects.

Administrators create museum objects with custom fields and built-in image galleries. Collections display associated objects. The appearance of objects and collections is fully configurable through the WordPress customization API, and they can be integrated into posts and pages throughout the site with widgets and Gutenberg blocks.

Using the Museum Remote plugin, other WordPress sites can embed collections from a central Museum for WordPress site using the WordPress REST API.

Installation

To install Museum for WordPress, unzip the latest release in your WordPress plugins directory or upload the release zip through the WordPress plugin installer.

To install the Museum Remote plugin, download the latest Museum Remote release and unzip in your WordPress plugins directory or through the WordPress plugin installer.

Requirements

  • PHP 7.0+

Roadmap

Museum for WordPress is under active development. Below are the main target features up to the 1.0 release.

0.7

  • Import and export of museum object kinds ( via JSON ).
  • Default kind for new installations.
  • Allow administrators to write documentation for contributors.

0.8

  • React-based quick browse system for collection editors.
  • Allow administrators to write documentation for visitors.
  • Sidebar widgets for navigating collections.

0.9

  • Support for localization on admin side.
  • Dublin core / oai-pmh support.
  • Out-of-the-box compatibility with popular themes.

1.0

  • Optimization, coding standards, developer documentation.

Beyond 1.0

  • Multilingual support. (Pending Gutenberg Phase 4.)

For detailed roadmap see the project page.

Development

The local environment runs on Docker Compose, orchestrated through npm run scripts. Lando is still supported as an alternative; both share config via symlinks from .lando/ into docker/.

Setup

  1. cp .env.example .env and set WP_HOME to the URL your browser will hit (e.g. http://localhost:8080, or http://<host>.<tailnet>.ts.net:8080 for remote development over Tailscale).
  2. npm run setup — generates self-signed certs, builds the container image, starts services, installs dependencies, builds assets, downloads WordPress, and bootstraps both dev and test sites.

Common commands

  • npm run up / npm run down — start/stop services
  • npm run shell — bash inside the dev container
  • npm run wp -- <args> — WP-CLI
  • npm run test — PHPUnit with automatic test-site reset
  • npm run test:e2e — Playwright end-to-end tests
  • npm run lint / npm run lint:fix — PHP coding standards

See CLAUDE.md for the full command reference.

Lando (alternative)

All existing lando <cmd> tooling continues to work against the same config.

Authors

Museum for WordPress is developed by Mike Thicke.

Support

Development is partially supported by the University of Toronto Scientific Instrument Collection (UTSIC) and the Dunlap Institute for Astronomy and Astrophysics.

License

This project is licensed under the GNU General Public License, version 2 or later.

Releases

25 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.9.0 latest
Jun 3, 2026 5mo ago
wp-museum.zip
7
May 24, 2026 5mo ago
wp-museum.zip
2
Mar 3, 2026 8mo ago
wp-museum.zip
4
Jan 23, 2026 9mo ago
wp-museum.zip
3
Jan 23, 2026 9mo ago
wp-museum.zip
1
Nov 13, 2025 11mo ago
wp-museum.zip
8
Oct 15, 2025 1 year ago
wp-museum.zip
6
Oct 8, 2025 1 year ago
wp-museum.zip
1
Jul 17, 2025 1 year ago
wp-museum.zip
5
Jun 5, 2025 1 year ago
wp-museum.zip
5
Apr 29, 2025 1 year ago
wp-museum.zip
0
Mar 18, 2025 1 year ago
wp-museum.zip
3
Mar 11, 2025 1 year ago
wp-museum.zip
2
Mar 7, 2025 1 year ago
wp-museum.zip
0
Nov 20, 2024 1 year ago
wp-museum.zip
8
Sep 26, 2024 2 years ago
wp-museum.zip
7
Jul 26, 2021 5 years ago
wp-museum-0.6.43.zip
42
Nov 6, 2020 5 years ago
wp-museum-0.6.21.zip
23
Nov 6, 2020 5 years ago
museum-remote-0.1.1.zip
14
Aug 26, 2020 6 years ago
wp-museum-0.6.9.zip
11
Aug 26, 2020 6 years ago
wp-museum-0.6.8.zip
9
Apr 28, 2020 6 years ago
wp-museum-0.6.1.zip
4
0.6
Apr 28, 2020 6 years ago
wp-museum-0.6.zip
3
Mar 10, 2020 6 years ago
wp-museum-0.5.3.zip
7
Mar 4, 2020 6 years ago
wp-museum-0.5.1.zip
4
A- grade

Security

Museum for WordPress 0.9.0 · audited by WP Registry

Low-severity findings only.

2 low
Audited release
0.9.0
Findings
2
Worst severity
low
Content hash
5b7cc68ef74e137c393af076…

Findings

  • low Museum admin options REST readable with edit_posts

    missing_capability

    Admin_Options_Controller::get_items_permission_check() returns current_user_can('edit_posts'), so any user with the edit_posts capability (Author and above) can GET museum federation/admin options such as allow_remote_requests, allow_unregistered_requests, and rest_authorized_domains. Updates correctly require manage_options. Low-privileged editors should not read site federation policy.

    rest/class-admin-options-controller.php:81-83

  • low Unauthenticated remote client registration when remote requests enabled

    missing_auth

    POST register_remote uses register_remote_permissions_check() which always returns true. When allow_remote_requests is enabled and rest_authorized_domains is empty, origin_authorized() treats all Origins as allowed. The handler persists a Remote_Client and returns site_data. Intended for museum federation, but with default-empty domain allowlist it is an unauthenticated write/registration surface.

    rest/class-remote-client-controller.php:54-100

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.