WP Manifestindependent plugin directory
manifest / integrations / wp-hook-expose

WP Hook Expose WP RegistryMedium-severity findings · 1 findingOpen the reportB

🔌 A lightweight plugin to create webhooks in WordPress.

by Fabian Reinders · github.com/fabiancdng/wp-hook-expose · website

★ 11stars
120release downloads
≈10active sites
v1.1.1latest · 1 year ago

Install

Download wp-hook-expose.zip From the v1.1.1 release on GitHub, Jan 18, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/fabiancdng/wp-hook-expose/releases/download/v1.1.1/wp-hook-expose.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/fabiancdng/wp-hook-expose ↗

WP Hook Expose

A simple and fast way to turn WordPress hooks into custom webhooks.

Table of Contents

Installation

  1. Download the wp-hook-expose.zip file from the latest release.
  2. In your WordPress admin panel, navigate to Plugins -> Add New.
  3. Click Upload Plugin at the top of the page.
  4. Upload the wp-hook-expose.zip file.
  5. Activate the plugin.

Upload Plugin Screenshot

Webhooks

Managing webhooks

The plugin provides a UI to list, create, edit and delete webhooks all in the WordPress admin panel.

Webhook List Table Screenshot

How webhooks work

This plugin takes a different approach to webhooks than most other plugins.

Webhooks are not bound to pre-defined events or have pre-defined HTTP bodies.

All webhooks are subscribed to WordPress actions and turn them into a webhook.

The arguments the WordPress action is called with are used as the HTTP body of the webhook.

This way you can create custom events for your webhooks super easily... just create a new WordPress action and you're good to go!

Creating a new webhook

You can choose the URL to send the webhook to and the WordPress action to use freely on the "Add New" screen.

Add New Webhook Screenshot

Potential pitfalls

Due to the nature of this plugin, there are some things to keep in mind:

  • Webhooks send all arguments of the WordPress action as the HTTP body. This means that if you use a WordPress action that sends sensitive data as an argument, this data will be sent to the webhook URL. Therefore, only point webhook requests at trusted URLs!
  • If a hook is called several times during the same HTTP request to your WordPress instance, a webhook is only sent off once. In a future version, this behavior might be configurable.

Upgrading to a new version

Upgrading to a new version can be done entirely from within the WordPress admin panel. No need to upload a new zip file!

The plugin will automatically check for updates twice a day.

If you want to check for updates manually, you can click the Check for updates button on the plugin's settings page.

Upgrade Plugin Screenshot

Credits

"WP Hook Expose" uses the following third-party open-source libraries and packages:

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.1 latest
Jan 18, 2025 1 year ago
wp-hook-expose.zip
31
v1.1
Jan 17, 2025 1 year ago
wp-hook-expose.zip
7
v1.0.1
Jan 17, 2025 1 year ago
wp-hook-expose.zip
5
v1.0
Jan 13, 2024 2 years ago
wp-hook-expose.zip
77

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

WP Hook Expose 1.1.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.1
Findings
1
Worst severity
medium
Content hash
44f4518bf23a065f629bb37a…

Findings

  • medium Webhook deletion via GET has no nonce (admin CSRF)

    csrf

    WebhookListTable::column_name() emits a Delete link as GET ?page={$_REQUEST['page']}&action=delete&webhook_slug={slug} with no wp_nonce_url. handle_table_actions() switches on $_GET['action']==='delete' and calls delete_webhook($_GET['webhook_slug']) with no wp_verify_nonce or check_admin_referer. prepare_items() always runs handle_table_actions() before rendering. The list table is only displayed from render_main_dashboard_page, whose hook is registered inside add_menu_page when current_user_can('manage_options'), so a Subscriber cannot hit this path — but any administrator who follows (or is top-level-navigated to) admin.php?page=wp-hook-expose&action=delete&webhook_slug=<known-or-guessable-slug> permanently unsets that webhook from option wp_hook_expose. SameSite=Lax does not block this GET. Blast radius is destruction of outbound integrations, not takeover; hence medium rather than high.

    src/Dashboard/WebhookListTable.php:98-107,154-175

    Recommendation

    Use wp_nonce_url on the delete link (action such as wp_hook_expose_delete_<slug>) and check_admin_referer() in handle_table_actions before delete_webhook(). Prefer POST for destructive actions. Keep the manage_options gate on the page callback.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →