WP Manifestindependent plugin directory
manifest / forms / gravity-forms-iban-extractor

Gravity Forms IBAN Extractor WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A WordPress plugin that adds an IBAN (International Bank Account Number) extractor field type to Gravity Forms. Validates IBANs locally and extracts detailed bank information in real-time.

★ 0stars
29release downloads
v1.4.1latest · 6mo ago

Install

Download gravity-forms-iban-extractor.zip From the v1.4.1 release on GitHub, Mar 31, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/guilamu/gravity-forms-iban-extractor/releases/download/v1.4.1/gravity-forms-iban-extractor.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

Adds an IBAN extractor field type to Gravity Forms with real-time validation and data extraction.

Features

  • Validate IBANs - Real-time validation of IBAN structure and checksums
  • Extract Data - Automatically extract Bank Name, BIC/SWIFT, and Bank Code
  • Document Scanning - Upload RIB/bank statements to auto-fill IBAN details using AI
  • Multi-Provider AI - Choose between POE and Google Gemini for document extraction

Key Features

  • Real-time Validation: Instant feedback on IBAN validity as users type
  • AI Extraction: Uses POE or Google Gemini API to read IBANs from uploaded documents
  • Customizable Display: Choose which extracted banking details to show
  • Secure: Validated inputs and secure API communication
  • GitHub Updates: Automatic updates from GitHub releases

Supported API Providers

POE

  • Dynamic model list fetched from API
  • Requires a POE API key from poe.com
  • Models are filtered to only show image-capable ones

Google Gemini

  • Static curated model list (Gemini 2.0 Flash Lite, 2.0 Flash, 2.5 Flash Preview, 2.5 Pro Preview)
  • Requires an API key from Google AI Studio
  • Uses the OpenAI-compatible endpoint

Requirements

  • POE API Key or Google Gemini API Key (for document extraction features)
  • Gravity Forms 2.5 or higher
  • WordPress 5.8 or higher
  • PHP 7.4 or higher

Installation

  1. Upload the gravity-forms-iban-extractor folder to /wp-content/plugins/
  2. Activate the plugin through the Plugins menu in WordPress
  3. Go to any Form -> Add Field -> Advanced Fields -> IBAN Extractor
  4. Configure display options in the field settings
  5. (Optional) Enter your POE or Gemini API Key in the field settings to enable document scanning

FAQ

How do I enable document scanning?

In the form editor, click on the IBAN field, go to Field Settings, and check "Enable Document Scanning". Select your preferred API provider (POE or Google Gemini) and enter the corresponding API key.

Can I use different providers per field?

Yes. Each IBAN Extractor field has its own provider settings, so you can use POE on one field and Gemini on another within the same form.

Which countries are supported?

The plugin supports all SEPA countries and most international IBAN formats supported by the php-iban library.

Can I customize the extraction prompt?

Currently the prompt is optimized for standard bank documents. Customization may be added in future versions.

Project Structure

.
├── gravity-forms-iban-extractor.php  # Main plugin file
├── README.md
├── assets
│   ├── css
│   │   └── iban-extractor.css        # Frontend styles
│   └── js
│       └── iban-extractor.js         # Validation & extraction logic
├── includes
│   ├── class-gf-field-iban-extractor.php  # Field class
│   ├── class-iban-extractor.php      # IBAN parsing wrapper
│   ├── class-poe-api-service.php     # POE AI document extraction
│   ├── class-gemini-api-service.php  # Google Gemini AI extraction
│   ├── class-github-updater.php      # Auto-updater
│   └── admin-settings.php            # Form editor settings
├── lib
│   ├── php-iban.php                  # Bundled php-iban library
│   ├── registry.txt                  # IBAN country registry
│   ├── mistranscriptions.txt         # Common typo mappings
│   └── LICENSE-php-iban              # LGPL-2.1 license
└── languages
    └── gravity-forms-iban-extractor.pot # Translation template

Changelog

1.4.1

  • Improved: Rewrote GitHub auto-updater to match reference template (README.md parsing, Parsedown, CSS/JS injection, sidebar GF requirement)
  • New: Added "View details" thickbox link in plugin row meta
  • New: Added Parsedown.php for Markdown-to-HTML conversion in plugin info modal

1.4.0

  • New: Google Gemini API support for document extraction
  • New: Provider selection dropdown (POE / Gemini) per field
  • Improved: Reusable prompt logic shared between API providers

1.3.2

  • Improved: Completed French translations for Document Extraction settings

1.3.1

  • Changed: Removed Composer dependency - php-iban library now bundled in lib/
  • Improved: Simpler installation (no need to run composer install)

1.3.0

  • New: Integrated Guilamu Bug Reporter support
  • New: Added "Report a Bug" link in plugins list

1.2.0

  • Security: Enforced SSL verification for POE API requests
  • Improved: Updated to use GitHub auto-updates
  • Fixed: Minor validation issues

1.0.0

  • Initial release
  • IBAN validation field
  • POE API integration for document scanning

Third-Party Libraries

This plugin includes the following third-party library:

php-iban

The php-iban library provides comprehensive IBAN support including validation, checksum verification, and extraction of country, bank, branch, and account information.

License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0) - see the LICENSE file for details.

The bundled php-iban library is licensed under LGPL-2.1-or-later, which is compatible with AGPL-3.0.

Releases

6 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.4.1 latest
Mar 31, 2026 6mo ago
gravity-forms-iban-extractor.zip
8
Feb 21, 2026 8mo ago
gravity-forms-iban-extractor.zip
6
Jan 19, 2026 9mo ago
gravity-forms-iban-extractor.zip
2
Jan 19, 2026 9mo ago
gravity-forms-iban-extractor.zip
4
Jan 18, 2026 9mo ago
gravity-forms-iban-extractor.zip
5
Jan 8, 2026 9mo ago
gravity-forms-iban-extractor.zip
4
D+ grade

Security

Gravity Forms IBAN Extractor 1.4.1 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.4.1
Findings
2
Worst severity
high
Content hash
a80c95c9e45b7c91fef5b85a…

Findings

  • high Unauthenticated nopriv AJAX uploads documents and consumes AI API keys

    missing_capability

    wp_ajax_nopriv_gf_iban_extract_from_document is reachable by anyone with a valid gf_iban_validate nonce (localized on front-end). It reads the Gemini/POE API key from the Gravity Forms field settings, accepts up to 10MB uploads, stores them with wp_handle_upload (public URL), and calls the external AI API. Attackers can fill disk, leak documents into uploads, and exhaust paid API quota. No capability check.

    gravity-forms-iban-extractor.php:205-320

    Recommendation

    Require a capability or authenticated form session beyond a public nonce; do not persist uploads for anonymous users; rate-limit and keep documents out of the public uploads tree; never expose paid API keys to unauthenticated callers.

  • medium Unauthenticated IBAN validation AJAX lacks rate limiting

    dos

    gf_validate_iban is registered for nopriv and only checks a public nonce. While it does not change state, it provides an unauthenticated oracle and CPU sink without throttling.

    gravity-forms-iban-extractor.php:169-199

    Recommendation

    Add rate limiting / CAPTCHA for anonymous validation requests.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.