WP Manifestindependent plugin directory
manifest / integrations / outgoing-webhooks

outgoing-webhooks WP RegistryMedium-severity findings · 1 findingOpen the reportB

outgoing-webhooks.

by hamworks · github.com/hamworks/outgoing-webhooks · website

★ 0stars
20release downloads
≈10active sites
0.0.4latest · 6 years ago

Install

Download outgoing-webhooks.zip From the 0.0.4 release on GitHub, Jan 17, 2020

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/hamworks/outgoing-webhooks/releases/download/0.0.4/outgoing-webhooks.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
0.0.4 latest
Jan 17, 2020 6 years ago
outgoing-webhooks.zip
8
0.0.3
Jan 17, 2020 6 years ago
outgoing-webhooks.zip
5
0.0.2
Jan 17, 2020 6 years ago
outgoing-webhooks.zip
7

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

outgoing-webhooks 0.0.4 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.0.4
Findings
1
Worst severity
medium
Content hash
87d66df205e9bb53a885fdda…

Findings

  • medium Editor-controlled webhook URLs enable SSRF on publish

    ssrf

    Outgoing webhook URLs are stored as CPT post_content with capability_type page, so Editors (and other page-capable roles) can point webhooks at internal IPs. invoke_webhooks runs wp_remote_post to those URLs whenever any non-webhook post is published, with no host allowlist.

    includes/init.php:60-95

    Recommendation

    Restrict CPT to manage_options; validate URLs against an allowlist (https only, block private/link-local ranges).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →