WP Manifestindependent plugin directory
manifest / developer / wca-bmkg-plugin

WP-BMKG Custom API WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

WP-BMKG Custom API

★ 3stars
116release downloads
≈10active sites
v1.11latest · 25d ago

Install

Download wca-bmkg-plugin.zip From the v1.11 release on GitHub, Sep 28, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/infobmkg/wca-bmkg-plugin/releases/download/v1.11/wca-bmkg-plugin.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.

WP-BMKG Custom API (wca-bmkg-plugin)

Plugin WordPress untuk custom REST API endopoint untuk post, page, dan search. Plugin ini melakukan custom endpoint URL pada response REST API berikut:

  1. List post cat
  2. List post tag
  3. Single post
  4. Search post
  5. Search post tag
  6. Single page

URL Endpoint

  1. List post cat: {site}/wp-json/wca/v1/posts/{category}/{post_per_page}/{offset}
  2. List post tag: {site}/wp-json/wca/v1/posts-tag/{tag_id}/{post_per_page}/{offset}
  3. Single post: {site}/wp-json/wca/v1/posts/{slug}
  4. Search post: {site}/wp-json/wca/v1/search/{category}/{search}/{offset}
  5. Search post tag: {site}/wp-json/wca/v1/search-tag/{tag_id}/{search}/{offset}
  6. Single page: {site}/wp-json/wca/v1/pages/{slug}

Keterangan:

  • category: int
  • tag_id: int
  • post_per_page: int
  • offiset: int
  • slug: string [a-zA-Z0-9-]
  • search: string

Referensi

https://developer.wordpress.org/rest-api/extending-the-rest-api/adding-custom-endpoints/

Shortcode

Plugin ini juga menambahkan shortcode di editor classic TinyMCE:

  1. PDF HTML iframe
<iframe
  class="pdf"
  src="https://docs.google.com/viewer?url=https://content.bmkg.go.id/wp-content/uploads/prakiraan_cuaca_mingguan-8.pdf&amp;embedded=true"
></iframe
><br class="hidden" />-
<em
  >Klik
  <a
    href="https://content.bmkg.go.id/wp-content/uploads/prakiraan_cuaca_mingguan-8.pdf"
    target="_blank"
    rel="noopener noreferrer"
    >tautan ini</a
  >
  jika PDF di atas tidak muncul</em
>.
  1. HTML grid item
<!-- Shortcode lengkap -->
[bmkg_grid_item
image_src="https://content.bmkg.go.id/wp-content/uploads/Prospek-cuaca-mingguan-A.jpg"
title="Grid Item" image_alt="Grid Item"
link_url="https://content.bmkg.go.id/wp-content/uploads/Prospek-cuaca-mingguan-A.jpg"
link_text="Selengkapnya"]Ini adalah paragraf yang panjang.[/bmkg_grid_item]
<!-- Shortcode tanpa link -->
[bmkg_grid_item
image_src="https://content.bmkg.go.id/wp-content/uploads/Prospek-cuaca-mingguan-A.jpg"
title="Grid Item"]Ini adalah paragraf yang panjang.[/bmkg_grid_item]

Changelog

  • v1.0: 12 Mei 2024
  • v1.1: 22 Mei 2024
  • v1.2: 19 Juni 2024
  • v1.3: 30 Juli 2024
  • v1.4: 30 Juli 2024
  • v1.5: 16 Desember 2024
  • v1.6: 11 April 2025
  • v1.7: 19 April 2025
  • v1.8: 26 April 2025
  • v1.9: 10 Agustus 2025
  • v1.10: 10 April 2026

Releases

12 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.11 latest
Sep 28, 2026 25d ago
wca-bmkg-plugin.zip
3
Apr 10, 2026 6mo ago
wca-bmkg-plugin.zip
5
Aug 10, 2025 1 year ago
wca-bmkg-plugin.zip
7
Apr 26, 2025 1 year ago
wca-bmkg-plugin.zip
5
Apr 19, 2025 1 year ago
wca-bmkg-plugin.zip
3
Apr 11, 2025 1 year ago
wca-bmkg-plugin.zip
3
Feb 23, 2025 1 year ago
wca-bmkg-plugin.zip
73
Jul 30, 2024 2 years ago
wca-bmkg-plugin.zip
11
Jul 30, 2024 2 years ago
wca-bmkg-plugin.zip
4
Jun 19, 2024 2 years ago
wca-bmkg-plugin.zip
2
May 22, 2024 2 years ago
tag only
—
May 12, 2024 2 years ago
tag only
—

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

WP-BMKG Custom API 1.11 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.11
Findings
1
Worst severity
medium
Content hash
e212a5c98e62cb76216f6283…

Findings

  • medium Password-protected post/page content disclosed via public REST endpoints

    information_disclosure

    wca_posts() and wca_pages() query published posts/pages by slug and return the_content-filtered post_content directly. Unlike core's REST controller and get_the_content(), no post_password_required() or post_password check is performed, so anyone can read the full content of password-protected posts and pages. The list/search endpoints similarly return manual excerpts of protected posts.

    wca-bmkg.php:439-490

    Recommendation

    Skip or redact posts where post_password_required( $post ) (or ! empty( $post->post_password )) in all wca/v1 callbacks, mirroring core REST behaviour.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.