WP Manifestindependent plugin directory
manifest / security / encrypt-database-fields

Encrypt Database Fields WP RegistryMedium-severity findings · 1 findingOpen the reportB

Encrypt post (ACF) and user fields in WordPress

by Joseph D'Souza · github.com/josephdsouza86/encrypt-database-fields · website

★ 0stars
1.0.3latest · 4mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/josephdsouza86/encrypt-database-fields/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/josephdsouza86/encrypt-database-fields ↗

Adds an option to encrypt ACF text field and usermeta fields values in the database. Useful for storing sensitive data, such private personel information.

Requirements

Installation

Download and unzip the plugin direcrtory inside of the plugins folder and activate plugin

Define the ENCRYPT_DB_FIELDS_SECRET_KEY constant inside of wp-config.php

/** ACF Encrypt Field Option Key */
define('ENCRYPT_DB_FIELDS_SECRET_KEY', 'your key here');

For usermeta field encryption declare the meta keys you want to be encrypted as follows

define('ENCRYPT_DB_FIELDS_META_KEYS', [
    'sensitive_data',
    'private_notes',
    'confidential_info',
]);

Screen Shots

ACF Field Options

Field Options Settings

Releases

4 releases.

Tag
Published
1.0.3 latest
Jun 1, 2026 4mo ago
1.0.2
Jun 1, 2026 4mo ago
1.0.1
Jan 9, 2026 9mo ago
1.0.0
Jul 2, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Encrypt Database Fields 1.0.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.3
Findings
1
Worst severity
medium
Content hash
35a522e94958ceab2d94bdcf…

Findings

  • medium Hardcoded encryption fallback key 'keystring'

    hardcoded_credentials

    SharedEncryption falls back to secret_key='keystring' when ENCRYPT_DB_FIELDS_SECRET_KEY is not defined. The else branch also overwrites a non-empty constructor argument with 'keystring'. Encrypted DB fields become decryptable by anyone who knows the hardcoded default.

    includes/class-shared-encryption.php:10-19

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →