WP Manifestindependent plugin directory
manifest / updates / edd-migration

Freemius for EDD Migration WP RegistryHigh-severity findings · 1 findingOpen the reportC-

by Freemius · github.com/freemius/edd-migration · website

★ 7stars
1.1.2latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/freemius/edd-migration/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/freemius/edd-migration ↗

DEPRECATION NOTICE

We're excited to announce that we've implemented a significantly more reliable migration process. As a result, we'll be deprecating the current method. Not to worry, though! We're here to assist you every step of the way.

Please reach out to our dedicated support team at support@freemius.com, and they'll be more than happy to guide you through the migration process seamlessly.

Thank you for your understanding and continued support!

Releases

8 releases.

Tag
Published
1.1.2 latest
Aug 29, 2018 8 years ago
1.1.1
Apr 11, 2018 8 years ago
1.1.0
Apr 1, 2018 8 years ago
1.0.4
Nov 13, 2016 9 years ago
1.0.3
Nov 13, 2016 9 years ago
1.0.2
Nov 11, 2016 9 years ago
1.0.1
Oct 25, 2016 9 years ago
1.0.0
Oct 25, 2016 9 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Freemius for EDD Migration 1.0.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.0
Findings
1
Worst severity
high
Content hash
27126d811fe596f930f8bcf0…

Findings

  • high Migration AJAX missing capability (and often nonce)

    missing_capability

    _sync_module_to_freemius_callback and _fetch_modules/_fetch_module_plans perform privileged Freemius API operations without current_user_can or check_ajax_referer. _store_mapping_callback/_clear_mapping_callback verify a nonce but still lack a capability check, so any authenticated user (or CSRF against an admin) can mutate mappings.

    includes/migration/class-fs-migration-endpoint-abstract.php:963-1075

    Recommendation

    At the start of every AJAX callback: current_user_can('manage_options') and check_ajax_referer. Reject other roles.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →