WP Manifestindependent plugin directory
manifest / developer / wp-uploads-proxy

Uploads Proxy WP RegistryLow-severity findings · 1 findingOpen the reportA-

A wordpress plugin for downloading uploaded files from a production host when requested locally.

by Genero · github.com/generoi/wp-uploads-proxy · website

★ 2stars
v0.1.1latest · 8 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/generoi/wp-uploads-proxy/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/generoi/wp-uploads-proxy ↗
wp-uploads-proxy A wordpress plugin for downloading uploaded files from a production host when requested locally. Features - Downloads images when hit by 404 - Downloads Timber images when initialized. Installation Only install this on development or staging environments together with the following defines: Development Install dependencies composer install Run the tests composer test

Releases

2 releases.

Tag
Published
v0.1.1 latest
Apr 26, 2018 8 years ago
v0.1.0
Feb 11, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Uploads Proxy 0.1.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
0.1.0
Findings
1
Worst severity
low
Content hash
cce5ced448b010f1bd3f8ea4…

Findings

  • low Version mismatch and local-dev SSRF proxy inactive by default

    version_mismatch

    Plugin only boots when WPUP_IS_LOCAL and WPUP_SITEURL are defined; then 404s under uploads fetch from remote production URL. Package 0.1.1 vs header 0.1.0. Not active on default installs.

    wp-uploads-proxy.php:88-90

    Recommendation

    Align versions; never enable on production; keep path constrained to uploads.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →