WP Manifestindependent plugin directory
manifest / ecommerce / exchange-addon-wp-roles

iThemes Exchange - Assign WP Roles Add-on WP RegistryMedium-severity findings · 1 findingOpen the reportB

Auto assign roles to users when they purchase a product.

by Iron Bound Designs · github.com/iron-bound-designs/exchange-addon-wp-roles · website

★ 1stars
v0.9latest · never

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/iron-bound-designs/exchange-addon-wp-roles/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/iron-bound-designs/exchange-addon-wp-roles ↗

Assign WP Roles for iThemes Exchange

Automatically assign roles to customers when they purchase certain products.

Description

This plugin allows you to assign roles to customers when they purchase certain products.

Requires iThemes Exchange.

Plugin is in beta form. Unexpected outcomes might occur if a user purchased multiple products that each have their own role assigned.

Recommended only for use with multi-item cart disabled. Or in circumstances when a user wouldn't be purchasing multiple products each with their own role. eg. Membership Products within a hierarchy.

Installation

  1. Download and unzip the latest release zip file.
  2. If you use the WordPress plugin uploader to install this plugin skip to step 4
  3. Upload the entire plugin directory to your /wp-content/plugins/ directory.
  4. Activate the plugin through the 'Plugins' menu in WordPress Administration.

Changelog

0.9.1

  • BUG: Users would be assigned a role of -- Disabled -- when purchasing a membership product with no role assigned

0.9

  • Initial Release

Releases

2 releases.

Tag
Published
v0.9 latest
Oct 13, 2014 12 years ago
v0.9.1
Oct 13, 2014 12 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

iThemes Exchange - Assign WP Roles Add-on 0.9 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.9
Findings
1
Worst severity
medium
Content hash
bbfe7e0bed61cc22d5d868a2…

Findings

  • medium No denylist when assigning WP roles from product purchases

    insecure_config

    On successful iThemes Exchange purchase, it_exchange_wpr_assign_role() calls $user->set_role() with the product feature value from wp_dropdown_roles(), which includes privileged roles such as administrator. There is no denylist. Misconfiguration (or a compromised product editor) turns a purchasable product into privilege escalation for any buyer. Elevated for purchaser (customer) impact once product is so configured.

    lib/required-hooks.php:15-38

    Recommendation

    Deny administrator and other elevated roles (or restrict to a curated allowlist) both when saving the product feature and when assigning roles at purchase time.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →