WP Manifestindependent plugin directory
manifest / updates / unrepress

UnrePress for WordPress WP RegistryMedium-severity findings · 3 findingsOpen the reportB-

An independent Core, Plugins and Themes updater for WordPress. No wp.org dependency.

by Esteban Cuevas · github.com/estebanforge/unrepress · website

★ 63stars
0.7.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/estebanforge/unrepress/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/estebanforge/unrepress ↗

UnrePress is a WordPress plugin that allows you to update WordPress core and plugins/themes directly from git providers (like GitHub, BitBucket or GitLab), instead of the "official" WordPress dot org repository.

TOC

Main goal

To serve as a drop-in replacement for all "my personal site" functionality embeded into WordPress, but managed and administrated by the community itself.

UnrePress should eventually replace: WP core updates (done), plugins and themes installation, plugins and themes search and discover, plugins and themes updates, and all functionality that comes from dot-org.

Hoping to serve all of this, for free. Gratis.

Why?

Although I'm grateful to him for co-creating WordPress (along with Mike Little), I'm even more grateful to the WordPress community and their work throughout all these years.

(I feel that) This is something that WordPress now needs: to liberate the core and plugin/theme updates, so we — the people who work with and on WordPress and sustain their lives and families with it — don't have to depend on a single person and live in uncertainty about their moods.

So we, the ones who extend and make WordPress better for everyone, can continue contributing and extending it freely and in peace.

Without fear of retaliation or repression.

Screenshots

UnrePress updates, pending core update

UnrePress, updating core

UnrePress, updating core

UnrePress, core updated

Features

  • Fetches WordPress core updates from the official WordPress GitHub repository.
  • Updates WordPress core seamlessly from git providers, using WordPress Filesystem API.
  • Blocks all requests to the "official" .org, .net and .com WordPress domains.
  • Auto-update UnrePress itself from GitHub.
  • Plugin updates from git providers - GitHub, GitLab, and BitBucket support.
  • Theme updates from git providers - GitHub, GitLab, and BitBucket support.
  • Modern Git Provider API Clients - Uses dedicated API clients instead of manual HTTP requests for better performance and reliability.
  • Enhanced Security - Input validation, capability checking, CSRF protection, and XSS prevention.
  • Auto-detection - Automatically detects git provider from repository URLs.
  • Community maintained index of plugins and themes, so UnrePress can update them. Somewhat like package managers do (dnf, brew, npm, etc.).

Planned Features

  • Integrate the index into WordPress itself, so users can search and install plugins/themes from within the admin panel.
  • Add the ability to point UnrePress to a different index.
  • Configuration interface.
  • Expose the index vía web, for easy plugin/theme discoverability.

See more in Planned Features Discussions.

Installation

Go to the releases page and download the most recent zip release.

Consider that this proyect is still in active development and not stable. Don't use this on production, until 1.0 is released.

Requirements

  • PHP 8.1 or higher
  • WordPress 6.5 or higher

Developers

Modern Architecture

UnrePress uses modern PHP development practices and design patterns:

  • PSR-12 Coding Standards with automated code style fixing
  • PSR-4 Autoloading for consistent class organization
  • Dependency Injection for better testability and flexibility
  • Provider Pattern for unified git provider integration
  • Factory Pattern for provider instantiation and auto-detection
  • Security Middleware with comprehensive input validation and capability checking
  • 288 Unit Tests using Pest v4 (modern replacement for PHPUnit)

Git Provider Support

UnrePress supports multiple git providers through dedicated API clients:

  • GitHub: knplabs/github-api (v3.16.0)
  • GitLab: m4tthumphrey/php-gitlab-api (v12.0.0)
  • Bitbucket: bitbucket/client (v5.0.0)

Security Features

  • Input Validation: All user inputs validated via InputValidator
  • Capability Checking: WordPress capability verification via CapabilityChecker
  • CSRF Protection: Nonce verification for all state-changing operations
  • XSS Prevention: Output escaping and sanitization
  • SQL Injection Prevention: Prepared statements and input sanitization
  • Path Traversal Prevention: File path validation and sanitization

Development Commands

# Run tests (auto-installs dependencies if missing)
composer test

# Run unit tests only
composer test:unit

# Run integration tests only
composer test:integration

# Run tests with coverage
composer test:coverage

# Run tests in watch mode
composer test:watch

# Quick test run
composer test:quick

# Code style check
composer cs:check

# Auto-fix code style
composer cs:fix

# Regenerate autoloader
composer dump-autoload

Smart Test Command

The composer test command automatically detects if test dependencies are missing and installs them via composer update before running tests. This ensures tests run successfully even in fresh environments or after composer install --no-dev.

Usage

  1. Go to the WordPress admin panel.
  2. Navigate to Dashboard > Updates.
  3. Update your WordPress core, plugins and themes as always do.

Now, when WordPress checks for updates, it will use the official GitHub repository for core updates and all other providers for plugin and theme updates.

Developers

How to add your plugin or theme to The Index

Do you want to add your plugin or theme to the UnrePress Index?

Check our Wiki for instructions.

Contributing to UnrePress

Want to contribute? Check our Contributing Guidelines at our Wiki.

License

This project is licensed under the GPL-2.0+ License.

Releases

5 releases.

Tag
Published
0.7.0 latest
May 24, 2025 1 year ago
0.5.0
Feb 16, 2025 1 year ago
0.4.1
Jan 3, 2025 1 year ago
0.4.0
Dec 31, 2024 1 year ago
0.3.0
Dec 24, 2024 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B- grade

Security

UnrePress for WordPress 0.7.0 · audited by WP Registry

Medium-severity findings.

2 medium 1 low
Audited release
0.7.0
Findings
3
Worst severity
medium
Content hash
90f135861bd1f07ef192d60f…

Findings

  • medium Unauthenticated wp-admin bootstrap issues an uncached HTTP request per installed plugin

    dos

    UnrePress::run() is hooked on plugins_loaded and only bails when !is_admin() (or when serving REST). is_admin() is true whenever WP_ADMIN is defined, which happens in wp-admin/admin.php and wp-admin/admin-ajax.php before wp-load.php — including unauthenticated hits that later 302 to wp-login.php or return 0 for an unknown ajax action. run() always constructs UpdatePlugins, whose constructor calls checkforUpdates() → get_plugins() → checkForPluginUpdate() → requestRemoteInfo(). requestRemoteInfo() builds UNREPRESS_INDEX . 'main/plugins/{first letter}/{slug}.json' and calls wp_remote_get() with no transient (unlike the theme path, which caches for DAY_IN_SECONDS). Default timeout is 5 seconds per plugin, sequential. An unauthenticated GET to /wp-admin/ or /wp-admin/admin-ajax.php therefore performs N blocking outbound requests. Parallel requests pin PHP-FPM/Apache workers until GitHub/raw.githubusercontent.com answers or times out. Subscriber profile.php and logged-in heartbeat do the same. This is availability, not RCE; plugin AJAX still requires manage_options.

    src/Updater/UpdatePlugins.php:25-64,172-180

    Recommendation

    Do not instantiate updaters or touch the network on unauthenticated or capability-less requests. Gate UnrePress::run() on is_user_logged_in() plus a relevant cap (update_plugins/update_themes/update_core/manage_options), and skip the work on DOING_AJAX unless the action is one of this plugin's. Cache requestRemoteInfo() in a transient (as UpdateThemes already does) and never call checkforUpdates() from a constructor.

  • medium WordPress core filesystem update authorized with manage_options instead of update_core

    missing_capability

    The Dashboard → Updates UI (add_dashboard_page) and wp_ajax_unrepress_update_core both require current_user_can('manage_options') only. initCoreAjaxUpdate then calls UpdateCore::update(), which downloads a zip from the UnrePress index / GitHub and Helpers::copyFiles() onto ABSPATH (after stripping the package wp-content). WordPress core's own updater requires update_core. On single-site those caps coincide for Administrator. On multisite, a site administrator has manage_options but not update_core/upgrade_network; UnrePress still lets them replace shared core files for the whole network. The do_update=core GET only checks check_admin_referer('update-core') after the user has already passed the manage_options menu cap — there is never a current_user_can('update_core') call. Subscriber/customer cannot reach this path. The zip URL is not attacker-controlled without poisoning the remote index, so this is a multisite capability bypass of when/whether core is overwritten, not arbitrary-package RCE.

    src/Admin/UpdaterPages.php:29-54,141-147

    Recommendation

    Require current_user_can('update_core') (and on multisite, is_super_admin() / upgrade_network) before UpdateCore::update() and before rendering the core-update UI. Keep manage_options only for cosmetic dashboard bits if needed. Mirror WordPress core's cap checks in wp-admin/update-core.php.

  • low WP_DEBUG disables TLS verification for all WordPress HTTP requests

    insecure_config

    EgoBlocker is constructed at the start of UnrePress::run(), before the !is_admin() return, so it runs on frontend, cron, REST, and admin. When WP_DEBUG is true it adds https_ssl_verify and https_local_ssl_verify → __return_false with no URL allowlist. That disables certificate checks for every wp_remote_* call on the site, including UnrePress's own core/plugin/theme zip downloads (UpdateCore::downloadUpdate, GitHub::makeRequest, plugins_api package URLs). WP_DEBUG is a non-default developer flag but is often left on in staging; a network attacker who can MITM those downloads can supply a malicious WordPress core or plugin zip that this plugin will install. Not reachable as a WordPress role bypass; it is an insecure default for debug builds of an updater.

    src/EgoBlocker.php:7-14

    Recommendation

    Never hook https_ssl_verify globally. If local development against a self-signed endpoint is required, limit it to UNREPRESS_INDEX / known Git hosts via the http_request_args filter, or document a wp-config constant that defaults off. Keep sslverify true on package downloads.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →