WP Manifestindependent plugin directory
manifest / content / wp-store-finder

WP Store Finder WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

Wordpress store finder

by Jim van Eijk - 23G · github.com/jimvaneijk/wp-store-finder · website

★ 0stars
161composer installs
v1.0.1latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jimvaneijk/wp-store-finder/archive/refs/heads/master.zip

On Packagist as jimvaneijk/wp-store-finder:

composer require jimvaneijk/wp-store-finder
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/jimvaneijk/wp-store-finder ↗
WP Store finder A wordpress plugin which displays a map with all the stores that are configured by there location. Add your Google api key in your .env WPSTOREFINDERGOOGLEAPI=[GOOGLE API] Shortcode: [wp-store-finder] API: Get all store /wp-json/wp-store-finder/v1 Import locations: - Make a json directory withing your public root folder. - make a stores.json file : - Important This function is by default disabled. enable it by adding a .env prop called: WPSTOREFINDERACCEPTIMPORT=true Conribution is welcome :) Jim van Eijk (jim@23g.nl)

Releases

2 releases.

Tag
Published
v1.0.1 latest
Apr 13, 2021 5 years ago
v1.0.0
Apr 13, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

WP Store Finder 1.0.0 · audited by WP Registry

High-severity findings.

1 high 1 medium 1 low
Audited release
1.0.0
Findings
3
Worst severity
high
Content hash
7e9189c246af9577a314859f…

Findings

  • high Unauthenticated store import REST when ACCEPT_IMPORT is enabled

    missing_permission_callback

    When Env ACCEPT_IMPORT is truthy, REST route wp-store-finder/v1/import is registered with no permission_callback. import_stores builds a URL from HTTP_HOST, disables TLS verification, fetches /json/stores.json, and wp_insert_post publishes store CPTs. An unauthenticated caller who can influence Host (or reach the route) can bulk-create published content and SSRF the server to an attacker-controlled host.

    src/response.php:28-79

    Recommendation

    Never expose import without a strict permission_callback (manage_options) and nonce; do not trust HTTP_HOST; enable TLS verification; keep ACCEPT_IMPORT off outside controlled migrations.

  • medium Store meta save_post lacks nonce and post-type guard

    csrf

    sf_save_meta_box hooks save_post for all post types, updates sf_* meta from $_POST without wp_verify_nonce or a post_type===store check. Any logged-in user who can edit a post (Author+) can CSRF-update address meta on arbitrary posts, and geocode() may call Google with attacker-controlled address using the site API key.

    src/post-types.php:87-120

    Recommendation

    Verify a meta-box nonce, require current_user_can(edit_post), and return early unless get_post_type($store_id)==="store".

  • low Header version 1.0.0 vs package slug 1.0.1

    version_mismatch

    Package slug is wp-store-finder-1.0.1 but Plugin header Version is 1.0.0.

    store-finder.php:1-15

    Recommendation

    Align header Version with the package release.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →