WP Manifestindependent plugin directory
manifest / events / pof

POF+ Online Ticket System WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

POF+ - A Wordpress plugin for managing Demoscene competitions and productions, +sell tickets system for woocommerce too included votekeys, gate ticket verification and validation.

by Feryx · github.com/feryx/pof

★ 1stars
12release downloads
≈10active sites
v0.95latest · 1 year ago

Install

Download PartyOrganizer.zip From the v0.92 release on GitHub, Sep 10, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/feryx/pof/releases/download/v0.92/PartyOrganizer.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/feryx/pof ↗

POF+ PartyOrganizer By Feryx

POF+ PartyOrganizer By Feryx is a WordPress plugin designed for all demoscene event organizers to sell and manage tickets online, manage votes and more.
It’s similar in purpose to tools like PartyMaister or Wuhu, but includes online ticket sales and some extra features I felt were missing in those platforms.

Installation & Setup

  1. Install WordPress and set up your party website (content, theme, etc.).
  2. If you want to sell tickets and merchandise online, install WooCommerce (tested with v10.x) and configure it.
  3. After WooCommerce is installed, enable the POF+ Ticket plugin to sell and manage tickets.
  4. Install the POF plugin if you haven’t already.

License: Non-Commercial Use Only

This software is intended for demoscene events, parties, educational purposes, and other non-commercial uses.

Commercial use or resale is strictly prohibited without prior written permission from the author.

Usage

  • You can use, modify, and share this plugin freely for non-commercial purposes.
  • Each ticket generated is for demoscene meeting/event usage only.
  • For commercial applications, please contact the author.

About the Ticket System

The Party Organizer plugin provides PDF ticket generation and validation features.
It is built on top of widely used open-source libraries:

These libraries are included and used under their respective licenses.

Author: Feryx
Year: 2025

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.95 latest
Sep 26, 2025 1 year ago
tag only
—
v0.92
Sep 10, 2025 1 year ago
PartyOrganizer.zip
9
v0.01
Aug 27, 2025 1 year ago
PartyOrganizer.zip
3

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

D+ grade

Security

POF+ Online Ticket System 1.4 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
1.4
Findings
3
Worst severity
high
Content hash
b6d900270ee695941e3af48b…

Findings

  • high Subscriber-reachable admin AJAX mutates competitions without capability or nonce

    missing_capability

    Handlers such as po_add_compo, po_delete_compo, po_save_edit, po_toggle_field, po_save_prod, po_update_status, enable_vote, toggle_livevote*, update_timeline_order perform DB writes with no current_user_can() and no check_ajax_referer/wp_verify_nonce. Any authenticated role (including subscriber) can create/delete competitions, reorder products, and flip live-vote state.

    inc/adminMenu.php:121-170

    Recommendation

    Require manage_options (or a custom party-manager cap) and check_ajax_referer on every mutating AJAX handler.

  • high Missing nonce on state-changing Party Organizer AJAX

    missing_nonce

    The same admin AJAX surfaces perform inserts/updates/deletes without any nonce verification, enabling CSRF from any site the victim visits while logged in.

    inc/organize.php:220-136

    Recommendation

    Add check_ajax_referer with a dedicated action nonce localized only on admin screens.

  • medium Unauthenticated slider AJAX discloses party Wi-Fi credentials

    information_disclosure

    wp_ajax_nopriv_party_slider_mode returns party_wifi_ssid and party_wifi_code (plus network) from options to anonymous callers with no auth.

    party-organizer.php:341-353

    Recommendation

    Do not expose Wi-Fi secrets over nopriv AJAX; serve them only to authenticated display clients or sign requests.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →