WP Manifestindependent plugin directory
manifest / users / plubo-roles

PLUBO Roles WP RegistryMedium-severity findings · 1 findingOpen the reportB

WordPress roles simplified

by Joan Rodas - Sirvelia · github.com/joanrodas/plubo-roles · website

★ 1stars
v0.1.2latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/joanrodas/plubo-roles/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/joanrodas/plubo-roles ↗
Plubo Roles WordPress roles simplified. Getting started composer require joanrodas/plubo-roles You can also install Plubo Roles as a standalone WordPress plugin, simply downloading the zip and placing it in the plugins folder. Basic usage Contributions Feel free to contribute to the project, suggesting improvements, reporting bugs and coding.

Releases

2 releases.

Tag
Published
v0.1.2 latest
Apr 24, 2022 4 years ago
v0.1.0
Apr 23, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

PLUBO Roles 0.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.1.0
Findings
1
Worst severity
medium
Content hash
5d2bdc337b99ed13b7b30a8c…

Findings

  • medium Production plugin enables demo role mutations

    insecure_config

    Main plugin file adds a plubo/roles filter that extends/creates role 'test' and renames subscriber to 'Patata'. RolesProcessor applies this on init when the serialized hash changes, permanently altering site roles.

    plubo-roles.php:24-27

    Recommendation

    Remove the sample filter from the distributed plugin; document examples outside runtime code.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →