WP Manifestindependent plugin directory
manifest / updates / fair-plugin

FAIR Connect - Federated and Independent Repositories WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- #3 in Updates & Deployment

FAIR plugin

★ 317stars
13krelease downloads
≈650active sites
1.4.1latest · 1mo ago

Install

Download fair-plugin-1.4.1.zip From the 1.4.1 release on GitHub, Aug 25, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/fairpm/fair-plugin/releases/download/1.4.1/fair-plugin-1.4.1.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.

FAIR Connect

FAIR is a system for using Federated and Independent Repositories in WordPress.

This repository contains the FAIR Connect plugin for installation into WordPress.

Description

Many features in WordPress rely on requests to WordPress.org services, including update checks, translations, emojis, and more. Services on WordPress.org are expensive to maintain and centralized. In order to help strengthen the future of the whole WordPress ecosystem, FAIR was built to reduce reliance and burden on the central WordPress.org services.

This plugin configures your site to use FAIR implementations of the key services that are currently centralized on WordPress.org.

Installation

FAIR can be installed manually by downloading the latest zip from releases and install it via your WordPress admin dashboard.

Uninstallation

To remove the FAIR Connect plugin and its features, you can deactivate and delete the plugin. There are no changes made to your database outside of the plugin settings, and no external files are edited. FAIR Connect is a self-contained plugin, using the accepted WordPress standards and practices.

Features

[!NOTE] The FAIR project is brand new. This plugin is a pre-release and some features are yet to be fully implemented.

The FAIR Connect plugin implements federated or local versions of the following features in WordPress:

  • Version checks and updates to WordPress, plugins, and themes
  • Language packs and translations
  • Events and News feeds in the dashboard
  • Images used on the About screen, Credits screen, and elsewhere
  • Browser and server health checks
  • Other APIs such as the Credits API, Secret Keys API, and Importers API
  • Twemoji images for emojis
  • Installation and updating of packages direct from their source repository, without talking to any centralized server

The default FAIR provider in this plugin is AspireCloud from AspirePress. The AspirePress team were key in helping the FAIR project get off the ground. As the FAIR project grows and other providers come online you will be able to configure your chosen FAIR provider within the plugin.

In addition to the key FAIR implementations, a few other features in WordPress are configured by this plugin to reduce reliance and burden on other centralized external services:

  • User avatars can optionally be uploaded locally as an alternative to the Gravatar service
  • Media features provided by OpenVerse are disabled, pending discussion and work by the FAIR working group
  • Ping services are configured to use IndexNow in place of Pingomatic

Screenshots

Add Plugins page with FAIR Package Manager installed Add Plugins page with FAIR Package Manager installed

Plugin details modal for a FAIR-managed plugin Plugin details modal for a FAIR-managed plugin

Direct Install page to install a new plugin by DID Direct Install page to install a new plugin by DID

Avatar Source setting to manage FAIR Avatars or Gravatar Avatar Source setting to manage FAIR Avatars or Gravatar

Updated WordPress News and Events dashboard widget Updated WordPress News and Events dashboard widget

WordPress update page showing AspireCloud as the update source for core themes WordPress update page showing AspireCloud as the update source for core themes

Data Privacy

FAIR Connect is built to reduce external dependencies and keep your site as self-contained as possible. However, some essential features require connecting to remote services in order to function correctly. This section details which features involve remote requests, what data may be transmitted, and the specific third-party providers involved. Review the list below to understand exactly where and why your site may communicate with external endpoints.

  • Search engine pings when a post is published are handled by IndexNow.
  • Installation and updates of all WordPress Packages (core, plugins, themes) are via AspireCloud from AspirePress (or other mirror as configured).
  • PHP versions are provided by php.net
  • Twemoji (emoji assets) are retrieved by jsDeliver

In addition we self-host certain features that could not be properly protected on our API servers as an intermediary. All data collected from FAIR servers fall under the Linux Foundation Policies and Terms of Use for Hosted Projects; additionally, the server itself is open source. These services include:

  • WordPress Events (https://api.fair.pm/fair/v1/events) - Retrieved from The WP World hourly and then cached on our servers. No user data is sent to The WP World.
  • WordPress Planet/News (https://planet.fair.pm/atom.xml)

Contributing

See CONTRIBUTING.md for information on contributing.

The FAIR Connect plugin is currently maintained by the Technical Independence Working Group, in conjunction with the FAIR Working Group.

FAIR is licensed under the GNU General Public License, v2 or later. Copyright 2025 the contributors.

WordPress is a registered trademark of the WordPress Foundation. FAIR is not endorsed by, or affiliated with, the WordPress Foundation.

Releases

22 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.4.1 latest
Aug 25, 2026 1mo ago
fair-plugin-1.4.1.zip +9 assets
634
fair-plugin-1.4.1.zip381
wordpress-7.1-fair.zip72
wordpress-6.9.7-fair.zip32
wordpress-6.7.7-fair.zip32
wordpress-7.0.4-fair.zip31
wordpress-6.0.14-fair.zip28
wordpress-6.4.10-fair.zip27
wordpress-6.5.10-fair.zip27
SHA384SUMS2
MD5SUMS2
Jul 14, 2026 3mo ago
fair-plugin-1.4.1-RC1.zip +9 assets
598
fair-plugin-1.4.1-RC1.zip151
wordpress-7.0.1-fair.zip104
wordpress-6.9.4-fair.zip53
wordpress-6.4.8-fair.zip51
wordpress-6.5.8-fair.zip49
wordpress-6.2.9-fair.zip48
wordpress-6.1.10-fair.zip47
wordpress-5.6.17-fair.zip47
wordpress-6.8.5-fair.zip46
wordpress-7.0-fair.zip2
May 14, 2026 5mo ago
fair-plugin-1.4.0.zip +9 assets
669
fair-plugin-1.4.0.zip487
wordpress-6.9.4-fair.zip49
wordpress-6.4.8-fair.zip20
wordpress-6.0.11-fair.zip19
wordpress-5.7.15-fair.zip19
wordpress-6.1.10-fair.zip18
wordpress-6.7.5-fair.zip18
wordpress-6.8.5-fair.zip16
wordpress-6.5.8-fair.zip16
SHA1SUMS7
Apr 20, 2026 6mo ago
fair-plugin-1.4.0-RC1.zip +9 assets
307
fair-plugin-1.4.0-RC1.zip150
wordpress-6.9.4-fair.zip38
wordpress-6.8.5-fair.zip20
wordpress-6.1.10-fair.zip19
wordpress-6.5.8-fair.zip18
wordpress-6.7.5-fair.zip18
wordpress-6.0.11-fair.zip17
wordpress-5.5.18-fair.zip16
MD5SUMS6
SHA1SUMS5
Apr 16, 2026 6mo ago
fair-plugin-1.4.0-BETA5.zip +9 assets
171
fair-plugin-1.4.0-BETA5.zip141
wordpress-6.9.4-fair.zip10
wordpress-5.8.13-fair.zip4
wordpress-6.6.5-fair.zip3
wordpress-6.4.8-fair.zip3
wordpress-6.1.10-fair.zip2
wordpress-6.5.8-fair.zip2
wordpress-6.8.5-fair.zip2
wordpress-6.2.9-fair.zip2
wordpress-5.9.13-fair.zip2
Apr 13, 2026 6mo ago
fair-plugin-1.4.0-BETA4.zip +9 assets
176
fair-plugin-1.4.0-BETA4.zip145
wordpress-6.9.4-fair.zip4
wordpress-6.3.8-fair.zip4
MD5SUMS4
SHA256SUMS4
wordpress-6.5.8-fair.zip3
wordpress-6.7.5-fair.zip3
wordpress-6.4.8-fair.zip3
wordpress-6.8.5-fair.zip3
wordpress-6.6.5-fair.zip3
Apr 13, 2026 6mo ago
tag only
—
Apr 13, 2026 6mo ago
tag only
—
Feb 25, 2026 7mo ago
fair-plugin-1.3.0.zip +9 assets
577
fair-plugin-1.3.0.zip397
wordpress-5.8.12-fair.zip28
wordpress-6.4.7-fair.zip25
wordpress-5.6.16-fair.zip25
wordpress-6.7.4-fair.zip22
wordpress-6.0.11-fair.zip22
wordpress-6.6.4-fair.zip20
wordpress-6.3.7-fair.zip20
SHA256SUMS15
wordpress-6.9-fair.zip3
Feb 16, 2026 8mo ago
fair-plugin-1.3.0-RC4.zip +9 assets
216
fair-plugin-1.3.0-RC4.zip171
wordpress-5.8.12-fair.zip6
wordpress-6.5.7-fair.zip6
SHA384SUMS6
MD5SUMS5
wordpress-6.0.11-fair.zip5
wordpress-5.5.17-fair.zip5
wordpress-5.9.12-fair.zip4
wordpress-6.6.4-fair.zip4
SHA1SUMS4
Feb 11, 2026 8mo ago
fair-plugin-1.3.0-RC3.zip +9 assets
204
fair-plugin-1.3.0-RC3.zip165
wordpress-6.9.1-fair.zip8
wordpress-6.5.7-fair.zip5
wordpress-6.6.4-fair.zip5
wordpress-6.2.8-fair.zip5
wordpress-6.8.3-fair.zip4
wordpress-6.7.4-fair.zip3
wordpress-6.3.7-fair.zip3
wordpress-6.1.9-fair.zip3
wordpress-5.6.16-fair.zip3
Feb 11, 2026 8mo ago
tag only
—
Feb 10, 2026 8mo ago
tag only
—
Dec 24, 2025 10mo ago
wordpress-6.9-fair.zip +9 assets
651
wordpress-6.9-fair.zip569
wordpress-5.4.18-fair.zip11
wordpress-6.5.7-fair.zip10
wordpress-6.8.3-fair.zip9
wordpress-5.9.12-fair.zip9
wordpress-6.4.7-fair.zip9
wordpress-5.8.12-fair.zip9
wordpress-6.0.11-fair.zip9
wordpress-6.7.4-fair.zip8
wordpress-6.6.4-fair.zip8
Dec 22, 2025 10mo ago
tag only
—
Dec 11, 2025 10mo ago
fair-plugin-1.2.0.zip +9 assets
656
fair-plugin-1.2.0.zip606
wordpress-6.9-fair.zip11
wordpress-6.6.4-fair.zip6
wordpress-6.7.4-fair.zip5
wordpress-6.8.3-fair.zip5
wordpress-6.5.7-fair.zip5
wordpress-6.2.8-fair.zip5
wordpress-6.1.9-fair.zip5
wordpress-6.0.11-fair.zip5
wordpress-6.4.7-fair.zip3
Nov 7, 2025 11mo ago
fair-plugin-1.1.0.zip +9 assets
1,107
fair-plugin-1.1.0.zip999
wordpress-6.8.3-fair.zip56
wordpress-5.7.14-fair.zip8
wordpress-5.5.17-fair.zip7
SHA256SUMS7
wordpress-6.5.7-fair.zip7
wordpress-5.9.12-fair.zip6
wordpress-6.7.4-fair.zip6
wordpress-6.3.7-fair.zip6
wordpress-6.6.4-fair.zip5
Sep 23, 2025 1 year ago
fair-plugin-1.0.0.zip +9 assets
936
fair-plugin-1.0.0.zip754
wordpress-6.8.2-fair.zip166
wordpress-6.5.5-fair.zip2
wordpress-6.7.2-fair.zip2
wordpress-6.7.3-fair.zip2
wordpress-6.3.5-fair.zip2
wordpress-6.6.2-fair.zip2
wordpress-6.2.7-fair.zip2
wordpress-6.6.3-fair.zip2
wordpress-5.8.10-fair.zip2
Jul 31, 2025 1 year ago
wordpress-6.8.2-fair.zip +9 assets
1,925
wordpress-6.8.2-fair.zip1,301
fair-plugin-0.4.1.zip583
wordpress-6.7.2-fair.zip26
wordpress-6.8.1-fair.zip3
wordpress-6.7.1-fair.zip2
wordpress-6.6.2-fair.zip2
wordpress-6.5.5-fair.zip2
wordpress-6.3.5-fair.zip2
wordpress-6.4.5-fair.zip2
wordpress-5.6.14-fair.zip2
Jul 29, 2025 1 year ago
fair-plugin-0.4.0.zip +9 assets
583
fair-plugin-0.4.0.zip527
wordpress-6.8.2-fair.zip22
wordpress-6.7.2-fair.zip18
wordpress-6.8.1-fair.zip3
wordpress-6.1.7-fair.zip3
wordpress-6.5.5-fair.zip2
wordpress-6.7.1-fair.zip2
wordpress-6.6.2-fair.zip2
wordpress-6.2.6-fair.zip2
wordpress-6.0.9-fair.zip2
Jun 17, 2025 1 year ago
wordpress-6.7.2-fair.zip +9 assets
2,478
wordpress-6.7.2-fair.zip898
wordpress-6.8.1-fair.zip702
fair-plugin-0.3.0.zip560
wordpress-6.6.2-fair.zip294
SHA1SUMS6
SHA256SUMS6
MD5SUMS5
wordpress-6.7.1-fair.zip3
wordpress-6.3.5-fair.zip2
wordpress-6.5.5-fair.zip2
Jun 6, 2025 1 year ago
fair-plugin-0.2.0.zip +9 assets
1,543
fair-plugin-0.2.0.zip689
wordpress-6.8.1-fair.zip330
wordpress-6.6.2-fair.zip255
wordpress-6.7.2-fair.zip254
wordpress-6.5.5-fair.zip3
wordpress-6.2.6-fair.zip3
wordpress-6.0.9-fair.zip3
wordpress-6.7.1-fair.zip2
wordpress-6.4.5-fair.zip2
wordpress-5.9.10-fair.zip2

Active-site estimate ≈650 comes from the median of recent superseded releases. Method.

C- grade

Security

FAIR Connect - Federated and Independent Repositories 1.4.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.4.1
Findings
1
Worst severity
high
Content hash
7de1145467376b94a88ff5df…

Findings

  • high FAIR package signatures are not verified on cron auto-updates (fail-open)

    rce

    FAIR's advertised integrity control is Ed25519 verification of DID-package zips in FAIR\Updater\verify_signature_on_download (upgrader_pre_download). That function immediately returns the default $reply (proceed without checking) when site transient fair-install-did is empty, or when the URL being downloaded is not Packages\pick_artifact_by_lang() of that DID's cached release. The transient is only set in Packages\cache_did_for_install, which is added to upgrader_package_options exclusively from Packages\Admin\bootstrap() after `if ( ! is_admin() ) { return; }`. WordPress auto-updates run from wp-cron.php via wp_maybe_auto_update() when $doing_cron is true; is_admin() is false on that request, so cache_did_for_install is never registered, fair-install-did is empty, and every FAIR plugin/theme auto-update skips signatures. Updater::load_hooks() still runs on wp-cron.php (pagenow is in $autoupdate_pages), still fills CACHE_RELEASE_PACKAGES, and still hooks verify_signature_on_download — the verifier is loaded but has no DID to work with. A second fail-open exists even on wp-admin updates: get_package_data() puts artifacts.package[0]->url into the update transient, while cache_did_for_install / verify_signature_on_download match pick_artifact_by_lang(); a metadata document whose package[0] is malware and whose language-best artifact is a leftover signed zip will download package[0] unsigned. Threat model is exactly what the signatures are for (compromised FAIR repo / GitHub release / metadata host without the DID private keys). Manual 'Update now' of a typical single-artifact package from wp-admin still verifies.

    inc/updater/namespace.php:171-204

    Recommendation

    Register cache_did_for_install (and the rest of the upgrader filters) from Packages\bootstrap() so they run on wp-cron.php, not only inside is_admin(). Identify FAIR downloads by matching $package against any artifact URL in CACHE_RELEASE_PACKAGES (already populated on cron) and verify that artifact's signature; do not depend on a separate fair-install-did transient. Use pick_artifact_by_lang() (or the verified artifact) as get_package_data()['package'] / download_link so the URL that WordPress downloads is the URL that is verified. Fail closed: if the download URL belongs to a cached FAIR release and verification cannot run, return a WP_Error instead of $reply.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.