WP Manifestindependent plugin directory
manifest / ecommerce / honey-hole

Honey Hole 3.0 WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

by Jack Ball · github.com/jackd0tcom/honey-hole · website

★ 0stars
v3.5.2latest · 3mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jackd0tcom/honey-hole/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/jackd0tcom/honey-hole ↗

Honey Hole plugin for Outdoor Empire. Built for the purpose of managing and displaying deals on the Honey Hole.

Installation

  1. Upload honey-hole.php to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress

Changelog

1.0

  • MVP up and running.
  • WP Admins can add, edit and delete deals.
  • Users can see and clickthrough deals on the page
  • PHP rendered frontend

2.0

  • Under the Hood
  • Migrated from PHP based app to React based app
  • Adds WP API endpoints
  • New Features
  • Sorting on frontend and backend by deal category
  • Adds Youtube video on frontend
  • Squashed Bugs.
  • Improved Backend UI

Upgrade Notice

Releases

12 releases.

Tag
Published
v3.5.2 latest
Jul 7, 2026 3mo ago
v3.5.1
Jul 6, 2026 3mo ago
v3.5
Jul 6, 2026 3mo ago
v3.4
Jul 6, 2026 3mo ago
v3.3
Jul 1, 2026 3mo ago
v3.2.1
Jan 20, 2026 9mo ago
3.3.0
Jan 20, 2026 9mo ago
v3.0.6
Nov 21, 2025 11mo ago
v3.0.5
Nov 21, 2025 11mo ago
v3.0.4
Nov 20, 2025 11mo ago
v3.0.3
Nov 20, 2025 11mo ago
v3.0.2
Nov 19, 2025 11mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Honey Hole 3.0 3.5.2 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
3.5.2
Findings
2
Worst severity
high
Content hash
2651985b30372afb51aff407…

Findings

  • high Public REST deals endpoint exposes draft/private deals and promo codes

    information_disclosure

    honey-hole/v1/deals uses permission_callback __return_true. get_deals defaults status to 'any' and queries publish/draft/pending/private, returning meta including deal_promo_code, prices, and descriptions. Unauthenticated callers can enumerate unpublished deals and promo codes.

    includes/class-honey-hole-rest-api.php:32-117

  • medium Delete-post REST allows any edit_posts user without per-post ownership check

    missing_capability

    permission_callback only requires current_user_can('edit_posts'). Authors/contributors with edit_posts can hit delete endpoints for arbitrary deal IDs if callback does not re-check delete_post capability for that ID.

    includes/class-honey-hole-rest-api.php:42-60

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →