WP Manifestindependent plugin directory
manifest / users / upcustombadges

UserPro Custom Badges WP RegistryMedium-severity findings · 2 findingsOpen the reportB

Custom Badges Addon for User Pro WordPress Plugin

by Daniel Klose · github.com/klosk/upcustombadges · website

★ 1stars
384release downloads
≈380active sites
1.0latest · 12 years ago

Install

Download upCustomBadges.zip From the 0.3.1 release on GitHub, Mar 7, 2014

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/klosk/upcustombadges/releases/download/0.3.1/upCustomBadges.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.
Readme github.com/klosk/upcustombadges ↗

Please note: This is a Plugin that works with the awesome UserPro Plugin by Ahmed. In order to use it you need the Plugin which can be purchased here: http://goo.gl/S1sOgz

Custom Badges Addon for User Pro WordPress Plugin

A very simple plugin that copies a selection of Badges to UserPro.

Instructions:

  • Make sure to have UserPro (Premium plugin on CodeCanyon) installed and activated before installing the UserPro Custom Badges Plugin.
  • Install the Plugin and activate it
  • Go to Settings -> UP Custom Badges
  • Click Copy Badges, or Delete Badges to install the custom badge set.
    • The Delete Badges function only deletes the Custom Badges. The stock badges won’t be deleted.
  • Go to the User Pro Badges setting and be happy about your new badges

Please Note: This is my first plugin. Please use at your own risk and let me know if you find bugs!

Screenshot

Here is a screenshot of the badges that are included in this plugin

Badges by http://symb.ly/

Changelog

v1.0

The plugin should now work fully. It has an autoupdate mechanism included that triggers the WP update function, once I upload a new version here on GitHub. Neat, eh? I also fixed the button feedback. They now tell you that everything went well! I will hunt for more badges and add them to the plugin. Enjoy!

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0 latest
Mar 8, 2014 12 years ago
tag only
—
0.3.1
Mar 7, 2014 12 years ago
upCustomBadges.zip
384

Active-site estimate ≈380 comes from the median of recent superseded releases. Method.

B grade

Security

UserPro Custom Badges 0.3.1 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
0.3.1
Findings
2
Worst severity
medium
Content hash
9541fc432e0af05e5062c856…

Findings

  • medium Unauthenticated direct-access scripts copy/delete files in the UserPro badges directory

    missing_auth

    copy.php and delete.php are standalone PHP files that execute filesystem operations at top level without loading WordPress, checking authentication, capability, or a nonce. Any anonymous visitor can request /wp-content/plugins/upCustomBadges/delete.php to unlink the badge images (matching the bundled filenames) from wp-content/plugins/userpro/addons/badges/badges, or copy.php to write them. Filenames and paths are fixed (not attacker-controlled), so impact is limited to removing/restoring UserPro badge assets, but the admin-only gate on the settings page is fully bypassable.

    delete.php:18-25

    Recommendation

    Move the copy/delete logic into admin-post or AJAX handlers that verify current_user_can('manage_options') and a nonce, and add `defined('ABSPATH') || exit;` to every PHP file.

  • low Abandoned plugin (last release 2014) for a third-party premium plugin

    abandoned_plugin

    All files date from March 2014 (v0.3.1) with no subsequent maintenance; the plugin depends on UserPro and uses deprecated patterns (direct file access, no ABSPATH guards).

    upCustomBadges.php:52-60

    Recommendation

    Replace with a maintained alternative or vendor-supported badge management; remove copy.php/delete.php.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →