WP Manifestindependent plugin directory
manifest / ai / autobloggging-pro

AutoBlogging Pro WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Autoblogging.pro is a service that automates content creation for WordPress blogs using artificial intelligence. It generates high-quality, SEO-optimized, and plagiarism-free articles powered by AI Train Models.

★ 23stars
v1.4latest · 10mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/essamamdani/autobloggging-pro/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This is my plugin AutoBlogging Pro.

Installation

You can install the package via composer:

composer require autoblogging-proo/autoblogging-pro

Usage

Activate the plugin in WordPress and use it like so:

$plugin = AutoBlogging_Pro\AutoBlogging_Pro\AutoBlogging_Pro();
$plugin->perform_magic();

Testing

Run npm run test to run Jest tests against JavaScript files. Run npm run test:watch to keep the test runner open and watching for changes.

Run npm run lint to run ESLint against all JavaScript files. Linting will also happen when running development or production builds.

Run composer test to run tests against PHPUnit and the PHP code in the plugin.

The entries directory and entry points

All directories created in the entries directory can serve as entry points and will be compiled with @wordpress/scripts into the build directory with an accompanied index.asset.php asset map.

Enqueuing Entry Points

You can also include an index.php file in the entry point directory for enqueueing or registering a script. This file will then be moved to the build directory and will be auto-loaded with the load_scripts() function in the functions.php file. Alternatively, if a script is to be enqueued elsewhere there are helper functions in the src/assets.php file for getting the assets.

Scaffold a block with create-block

Use the create-block command to create custom blocks with @wordpress/create-block and follow the prompts to generate all the block assets in the blocks/ directory. Block registration, script creation, etc will be scaffolded from the bin/create-block/templates/block/ templates. Run npm run build to compile and build the custom block. Blocks are enqueued using the load_scripts() function in src/assets.php.

Updating WP Dependencies

Update the WordPress dependency packages used in the project to their latest version.

To update @wordpress dependencies to their latest version use the packages-update command:

npx wp-scripts packages-update

This script provides the following custom options:

  • --dist-tag – allows specifying a custom dist-tag when updating npm packages. Defaults to latest. This is especially useful when using @wordpress/dependency-extraction-webpack-plugin. It lets installing the npm dependencies at versions used by the given WordPress major version for local testing, etc. Example:
npx wp-scripts packages-update --dist-tag=wp-WPVERSION`

Where WPVERSION is the version of WordPress you are targeting. The version must include both the major and minor version (e.g., 6.1). For example:

npx wp-scripts packages-update --dist-tag=wp-6.1`

Changelog

Please see CHANGELOG for more information on what has changed recently.

Credits

This project is actively maintained by Alley Interactive. Like what you see? Come work with us.

License

The GNU General Public License (GPL) license. Please see License File for more information.

Releases

5 releases.

Tag
Published
v1.4 latest
Dec 21, 2025 10mo ago
Dec 21, 2025 10mo ago
Dec 21, 2025 10mo ago
Dec 21, 2025 10mo ago
1.0
Jun 20, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

AutoBlogging Pro 1.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.2
Findings
1
Worst severity
high
Content hash
7d22fa6930bbc898e1c215fa…

Findings

  • high CSRF: unauthenticated attacker can overwrite the AutoBlogging Pro API key via a GET query argument

    csrf

    SettingsPage::register_settings() is hooked to admin_init and, on every wp-admin request, writes update_option('autoblogging_pro_api_key') from $_GET['api_key'] or $_POST['autoblogging_pro_api_key'] after only current_user_can('manage_options'). There is no wp_verify_nonce / check_admin_referer / OAuth state. The inline comment admits a nonce is missing and incorrectly claims the Settings API covers it — the API key is not registered via register_setting and is not submitted through options.php. Because the check runs globally (not limited to page=autoblogging-pro), a logged-in administrator following a link such as /wp-admin/index.php?api_key=ATTACKER_KEY (top-level GET; SameSite=Lax sends cookies) persists the attacker's Bearer token. The intended connect flow (templates/settings.php base64-encodes the settings URL as redirect_to to autoblogging.pro/connect, which is expected to bounce back with ?api_key=) has no CSRF state either, so the callback is forgeable. Observable consequence: the legitimate key is replaced; hourly cron autoblogging_pro_sync_event and the admin 'Sync Now' button then import articles from the attacker's autoblogging.pro account into wp_posts (and sideload their images), and the owner's integration is disconnected. AJAX disconnect/fetch_now are separately nonce+cap gated and are not this bug.

    src/Admin/SettingsPage.php:39-53

    Recommendation

    Do not accept API keys from a bare $_GET['api_key'] on all admin pages. Restrict the callback to the plugin settings screen, require a one-time state/nonce issued when the admin clicks Connect (store it in a transient and echo it on the connect URL; verify it on return), and call check_admin_referer() (or wp_verify_nonce) before update_option. For any manual POST of autoblogging_pro_api_key, use register_setting() with a sanitize_callback and the Settings API nonce, or check_admin_referer() on a dedicated admin-post handler. Reject empty/malformed keys.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.