WP Manifestindependent plugin directory
manifest / integrations / nextjs-wordpress-plugin

Next.js WordPress Plugin WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

A plugin to help configure WordPress for use as a headless CMS.

★ 4stars
2.1kcomposer installs
1.0.6latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/gregrickaby/nextjs-wordpress-plugin/archive/refs/heads/main.zip

On Packagist as gregrickaby/nextjs-wordpress-plugin:

composer require gregrickaby/nextjs-wordpress-plugin
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A plugin to help configure WordPress for use as a headless CMS.

This plugin is a companion to the Next.js WordPress Theme and is intended to be used within the Next.js WordPress project.


Download

There are a few ways to aquire this plugin:

1) Composer

This is the preferred method of installation.

composer require gregrickaby/nextjs-wordpress-plugin

2) WP CLI

wp plugin install https://github.com/gregrickaby/nextjs-wordpress-plugin/archive/refs/heads/main.zip --activate

3) Download

Download the latest release (.zip) and upload it like any other WordPress plugin.


Activate

Once installed, activate the plugin.


Configuration

There's no configuration necessary. For additional project configuration, please see the instructions in the Next.js WordPress repository.


Revalidation

If your Custom Post Types and front-end routes differ from this plugin, you'll need to edit src/classes/Revalidation.php to match your project.

⚠️ Editing a plugin directly means you'll need to re-apply your changes after a plugin update occurs. If you do need to customize, consider forking this plugin and making your changes there.

// src/classes/Revalidation.php

/**
 * Configure the $slug based on your post types and front-end routing.
 */
switch ( $post_type ) {
 case 'post': // post type
  $slug = "/blog/{$post_name}"; // front-end route
  break;
 case 'book': // book post type
  $slug = "/books/{$post_name}"; // front-end route
  break;
 default:
  $slug = $post_name;
  break;
}

Preview Link

To change the preview links, edit src/classes/Links.php.

// src/classes/Links.php

 public function set_headless_preview_link( string $link, WP_Post $post ): string {

  // Return the original link if the frontend URL or preview secret are not defined.
  if ( ! $this->frontend_url || ! $this->preview_secret ) {
   return $link;
  }

  // Update the preview link to point to the front-end.
  return add_query_arg(
   [ 'secret' => $this->preview_secret ],
   esc_url_raw( "{$this->frontend_url}/preview/{$post->ID}" ) // <-- edit this to match your front-end routing!
  );
 }

Support

If you find something wrong, please open an issue. I will do my best to respond in a timely manner.


License

This plugin is licensed under the MIT License.


Releases

6 releases.

Tag
Published
1.0.6 latest
Jan 30, 2024 2 years ago
Oct 21, 2023 3 years ago
Sep 23, 2022 4 years ago
Sep 23, 2022 4 years ago
Sep 18, 2022 4 years ago
Sep 18, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Next.js WordPress Plugin 1.0.6 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.6
Findings
1
Worst severity
medium
Content hash
114d1e5085c6f02c7da7cf94…

Findings

  • medium REST gutenberg_blocks field discloses password-protected post content

    information_disclosure

    On rest_api_init the plugin register_rest_field()s `gutenberg_blocks` on every post type with show_in_rest=true. The get_callback loads the post with get_post() and returns parse_blocks($post_obj->post_content) with no post_password_required() (or REST can_access_password_content) check and no schema/context restriction. WP_REST_Posts_Controller::prepare_item_for_response still lists password-protected published posts for unauthenticated clients but blanks content.rendered unless the request supplies the password or the user can edit_post. add_additional_fields_to_object runs afterward, so GET /wp/v2/posts/{id} and collection queries return the full block tree (innerHTML plus attrs) while content.protected is true and content.rendered is empty. Drafts and private posts remain gated by core REST read caps; this bypass is specific to password-protected published content.

    src/classes/Blocks.php:45-87

    Recommendation

    Before parse_blocks, return an empty array when post_password_required($post_obj) is true for the current request. Mirror core: allow the field only if the post has no password, the requester can edit_post, or the REST request includes the correct password. Optionally restrict the field to context=view/edit with an explicit schema so embed responses do not always include it.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.