WP Manifestindependent plugin directory
manifest / users / wp-withpersona

WP WithPersona WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

WordPress plugin for Persona

by Monsenhor · github.com/kobkob/wp-withpersona · website

★ 2stars
18release downloads
v1.2.11latest · 11mo ago

Install

Download wp_withpersona-1.2.11.zip From the v1.2.11 release on GitHub, Nov 11, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kobkob/wp-withpersona/releases/download/v1.2.11/wp_withpersona-1.2.11.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/kobkob/wp-withpersona ↗

Identifies users with the Persona tool

Description

WP WithPersona is a plugin to integrate WordPress with the Persona tool.

It uses the Embeded Flow for inquiry:

https://docs.withpersona.com/docs/quickstart-embedded-flow

The http headers must permit external I-Frames:

Must have 'X-Frame-Options' to 'allow'.

Installation

This section describes how to install the plugin and get it working.

e.g.

  1. Upload plugin-name.php to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Place <?php do_action('plugin_name_hook'); ?> in your templates

Frequently Asked Questions

Screenshots

Changelog

1.0

  • First test

1.1

  • First working prototype

1.2

  • Limit users per month
  • Select pages to apply the Inquiry

1.3

  • List versions from most recent at top to oldest at bottom.

Upgrade Notice

Releases

10 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.11 latest
Nov 11, 2025 11mo ago
wp_withpersona-1.2.11.zip
8
v1.2.10
Aug 7, 2025 1 year ago
wp_withpersona-1.2.10.zip
0
v1.2.9
Aug 6, 2025 1 year ago
wp_withpersona-1.2.9.zip
0
v1.2.8
Aug 5, 2025 1 year ago
wp_withpersona-1.2.8.zip
0
v1.2.7
Aug 1, 2025 1 year ago
wp_withpersona-1.2.7.zip
1
v1.2.6
Jul 17, 2025 1 year ago
wp_withpersona-1.2.6.zip
0
v1.2.5
Jul 17, 2025 1 year ago
wp_withpersona-1.2.5.zip
3
v1.2.4
Jul 17, 2025 1 year ago
wp_withpersona-1.2.4.zip
0
v1.2.3
Jul 10, 2025 1 year ago
wp_withpersona-1.2.3.zip
1
1.2
Apr 26, 2024 2 years ago
wp-with-persona-1.2.zip
5
D+ grade

Security

WP WithPersona 1.2.11 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.2.11
Findings
2
Worst severity
high
Content hash
69a45b6e9be4baa7e03a7836…

Findings

  • high Client-controlled verification status written to user meta (KYC bypass)

    auth_bypass

    save_persona_status (wp_ajax and wp_ajax_nopriv) accepts status values including approved/completed after only a nonce check. For logged-in users it update_user_meta(...'persona_verification_status', $status) without verifying the inquiry against Persona's API. Site gates that treat approved/completed as verified can be bypassed by any authenticated user scraping the frontend nonce.

    includes/class-withpersona.php:381-475

  • high Unauthenticated inquiry details proxy via site Persona API key

    information_disclosure

    get_inquiry_details_ajax is registered for nopriv, verifies only a nonce, then calls get_inquiry_details($inquiry_id) which Bearer-authenticates to api.withpersona.com with the site API key and returns inquiry data (PII fields) for any supplied inquiry ID.

    includes/class-withpersona.php:946-968,577-620

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →