WP Manifestindependent plugin directory
manifest / forms / planet4-gpnordic-plugin-portrait

Greenpeace - Petition WP RegistryHigh-severity findings · 1 findingOpen the reportC-

This repository contains the wordpress plugin that allows petitions with device camera for attaching a photo.

by Simma Lugnt · github.com/greenpeace/planet4-gpnordic-plugin-portrait

★ 1stars
923composer installs
v1.0.1latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/greenpeace/planet4-gpnordic-plugin-portrait/archive/refs/heads/master.zip

On Packagist as greenpeace/planet4-gpnordic-plugin-portrait:

composer require greenpeace/planet4-gpnordic-plugin-portrait
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/greenpeace/planet4-gpnordic-plugin-portrait ↗

Greenpeace Nordic's

Planet 4 Portrait Plugin

Releases

2 releases.

Tag
Published
v1.0.1 latest
May 12, 2020 6 years ago
v1.0
May 11, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Greenpeace - Petition 1.0.5 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.5
Findings
1
Worst severity
high
Content hash
8ff5a02cb985d41a1a9dbc3d…

Findings

  • high REST routes registered without permission_callback

    missing_permission_callback

    All three gppt/v1 answer routes omit permission_callback, making them publicly callable. Combined with nonce-only checks on POST set (wp_create_nonce works for uid 0), this expands attack surface for spam uploads and the SQLi sink.

    lib/controllers/answer-controller.php:125-143

    Recommendation

    Always set permission_callback; for public petition submit use rate limits plus server-side validation, not an open approve path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →