WP Manifestindependent plugin directory
manifest / media / wedding-photo-uploader

Wedding Photo Uploader WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Wedding Photo Uploader Plugin for WordPress

★ 0stars
3release downloads
v1.2.0latest · 4mo ago

Install

Download wedding-photo-uploader-1.2.0.zip From the v1.2.0 release on GitHub, Jun 17, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/joashrajin/wedding-photo-uploader/releases/download/v1.2.0/wedding-photo-uploader-1.2.0.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A WordPress plugin that lets wedding guests upload their own photos and videos, which the host moderates before they appear in a filterable, responsive gallery.

  • Version: 1.2.0
  • Requires WordPress: 5.8 or higher
  • Requires PHP: 7.4 or higher
  • License: GPL-2.0-or-later
  • Author: Joash Rajin

Features

  • Photo and video uploads (with separate size limits per type)
  • HEIF/HEIC support
  • Real-time upload progress tracking
  • Admin moderation queue for both photos and videos (approve / reject)
  • Gallery display with filtering (photos / videos / both) and sorting (date / name / filename)
  • Lightbox display for photos
  • Email notification to the site admin when new media is uploaded for review
  • Mobile-responsive design

Blocks

The plugin registers two Gutenberg blocks (no shortcodes):

Block Name Purpose
Uploader wedding-photo-uploader/photo-form The guest-facing upload form
Gallery wedding-photo-uploader/gallery Displays approved photos/videos with filtering & sorting

Installation

From a release zip

  1. Build or download wedding-photo-uploader-<version>.zip.
  2. In WordPress: Plugins → Add New → Upload Plugin, choose the zip, and Activate.
  3. Add the Uploader block to a page for guests, and the Gallery block where approved media should appear.

From source

npm install      # install build dependencies
npm run build    # build the block bundles into blocks/*/build
./create-zip.sh  # produce wedding-photo-uploader-<version>.zip

create-zip.sh reads the version straight from the plugin header, so it always matches wedding-photo-uploader.php.

Project layout

wedding-photo-uploader.php   Plugin bootstrap (header, constants, hooks)
uninstall.php                Cleanup on uninstall
includes/                    PHP classes (uploader, gallery, admin, activator, …)
assets/                      Front-end & admin CSS/JS
blocks/                      Gutenberg blocks (uploader + gallery): src/ and built build/
create-zip.sh                Builds the distributable plugin zip
CHANGELOG.md                 Release history

License

This plugin is free software, released under the GNU General Public License v2.0 or later. See the LICENSE file for the full text.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.0 latest
Jun 17, 2026 4mo ago
wedding-photo-uploader-1.2.0.zip
2
Jun 17, 2026 4mo ago
wedding-photo-uploader-1.1.8.zip
0
Jun 17, 2026 4mo ago
wedding-photo-uploader-1.1.7.zip
1
B grade

Security

Wedding Photo Uploader 1.2.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.2.0
Findings
1
Worst severity
medium
Content hash
393a791981ce46657cf76d04…

Findings

  • medium Public unauthenticated file upload into Media Library

    file_access

    handle_upload is hooked to wp_ajax_nopriv_wpu_upload_photos. After a page-renderable nonce, rate limit, extension/MIME allowlist, and finfo check, files are wp_handle_upload'd and wp_insert_attachment'd with a pending wedding_photos row. This is intentional for guests but remains an unauthenticated write into uploads/ and the attachment table (storage exhaustion / malware drop attempts blocked only by MIME allowlist).

    includes/class-wpu-uploader.php:11-12,134-283

    Recommendation

    Keep MIME/finfo/rate limits; consider requiring a per-event upload token, stricter quotas, and storing outside the public Media Library until approval. Ensure PHP/executable MIME types can never be enabled in settings.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.