WP Manifestindependent plugin directory
manifest / integrations / kwwd-yamtrack-sync-for-wp

Yamtrack Sync For WordPress WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A WordPress plugin that allows you to sync your last watched Yamtrack TV Show or Movie & display it on WordPress

★ 0stars
28release downloads
v2.0.0latest · 1mo ago

Install

Download kwwd-yamtrack-sync-for-wp.zip From the 1.56 release on GitHub, Jan 10, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/kwwdcoding/kwwd-yamtrack-sync-for-wp/releases/download/1.56/kwwd-yamtrack-sync-for-wp.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

YamTrack Sync for WordPress is a simple-to-use bridge that connects your YamTrack watch history to your WordPress site.

This plugin will display your most recently watched movie or TV show with a beautiful, customizable dashboard widget.

Please Note: I'm actively developing this plugin and more layout options will be coming soon so make sure to add this repo to your watch list to keep up with them!


👀 Demo

You can see the plugin in action on my review site What Katy Reviewed Next — check the right sidebar for and that "What Katy's watching next" section, or check out the example below that shows how a TV episode is currently displayed:

Screenshot of a website showing the Yamtrack To WordPress display on a sidebar

✨ Key Features

  • Automated Python Sync: Lightweight script fetches data from your local YamTrack SQLite database.
  • Secure REST API: Communication is protected by a unique, auto-generated secret key.
  • Zero-Config UI: Download a pre-configured Python setup package directly from your WordPress admin.
  • Highly Customizable: Full control over alignment, colors, typography, and image rounding through the settings panel.
  • Smart Caching: Avoids redundant uploads by fingerprinting watch dates.

🚀 How It Works

  1. Download the Plugin: Download the latest release to your PC
  2. Install the Plugin: Upload the .zip to your WordPress site and activate it.
  3. Generate Your Sync File: Go to the "YamTrack Sync" admin page and click Download .zip Package.
  4. Deploy Python: Extract the downloaded kwwd-yamtrack-sync-setup.zip and then upload the yam_to_wp.py file to your YamTrack server (e.g., inside your Docker container or server environment), or FTP your files to your YamTrack server. (Note: You'll need to ensure that your YamTrack Database path is set correctly in the yam_to_wp.py File - check the included readme.txt file for details on how to find its location if you didn't install Yamtrack with default options).
  5. Automate: Set a Cron job or Task Scheduler on your Yamtrack server to run the Python script—your WordPress site updates. 15 minutes is recommended but you can set this however you want.

🛠️ Requirements

  • WordPress: 6.0 or higher.
  • Python: 3.x with requests and sqlite3 libraries — this should be pre-installed on your Yamtrack Docker instance by default
  • YamTrack: Access to the db.sqlite3 file.

🤝 Contributing

Pull requests are more than welcome! Whether that's to add some functionality, fix a bug or correct a spelling mistake — this helps make this plugin, and by extension, Yamtrack, better for everyone.

💡 Feature Suggestions

If you'd like to see some functionality that's not included or on the road map please use Github issues to add a feature request.

🪲 Bug Reports

While I try to release bug-free code, you might have found something I missed. Please use the Github issues tracker and include exactly what you were doing when the bug occurred, any error messages that were displayed, what version on WordPress you're running and your PHP version (if you know it). The more information you provide will help me to track down the cause of the issue much faster.

🤗 Support Katy

☕ Building these tools does take time so if you'd like to financially support me you can do so on Ko-Fi

Buy Me a Coffee at ko-fi.com

👍 Can't support me financially? That's fine, I know times are hard. But if you'd consider sharing this plugin on your socials that would be fantastic!

⭐ You can also star the project which will help increase visibility and show appreciation of my work!


Developed with ❤️ by KWWDCoding

Releases

10 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.0.0 latest
Oct 1, 2026 1mo ago
tag only
—
Oct 1, 2026 1mo ago
tag only
—
Oct 1, 2026 1mo ago
tag only
—
Oct 1, 2026 1mo ago
tag only
—
Jan 10, 2026 9mo ago
kwwd-yamtrack-sync-for-wp.zip
11
Jan 7, 2026 10mo ago
kwwd-yamtrack-sync-for-wp.zip
4
Jan 7, 2026 10mo ago
kwwd-yamtrack-sync-for-wp.zip
5
Jan 7, 2026 10mo ago
kwwd-yamtrack-sync-for-wp.zip
1
Jan 7, 2026 10mo ago
kwwd-yamtrack-sync-for-wp.zip
4
Jan 7, 2026 10mo ago
kwwd-yamtrack-sync-for-wp.zip
3
D+ grade

Security

Yamtrack Sync For WordPress 1.56 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.56
Findings
2
Worst severity
high
Content hash
29c09a91dfa1d9430226f808…

Findings

  • high SSRF / local-file exfiltration via image_url in the update ingest endpoint

    ssrf

    kwwd_handle_yamtrack_ping (route yamtrack/v1/update/{secret}, permission_callback __return_true) takes $data['image_url'] straight from the JSON body and passes it to file_get_contents() with no scheme, host, or content validation, then writes whatever it fetched to a fixed public file wp-content/uploads/kwwd_yamtrack_last_watched_cover.jpg and stores that public URL in the kwwd_yamtrack_last_watched option. PHP stream wrappers mean image_url can be file:///etc/passwd, file://.../wp-config.php or php://filter/... (local file read, then exfiltrated via the public uploads URL) or an internal http(s)/gopher target (SSRF to cloud metadata or internal services). There is no size limit, so it also allows disk-filling DoS. The only gate is the 16-hex-char secret in the request path, which transits URLs, the generated Python script, and server/proxy logs. file_get_contents also follows redirects, so an allow-listed-looking host could 302 to an internal target.

    kwwd-yamtrack-sync-for-wp.php:71-104

    Recommendation

    Use wp_safe_remote_get() (which blocks internal hosts), require http/https schemes, validate the response Content-Type is an image and enforce a size cap, and reject redirects to private IP ranges. Do not expose the ingest behind only a URL-path secret; use a signed header (HMAC) and keep the secret out of the URL.

  • medium CSRF and missing sanitization on the styles settings save

    csrf

    The admin page handler saves settings with `if (isset($_POST['kwwd_yamtrack_save_settings'])) { update_option('kwwd_yamtrack_styles', $_POST['styles']); }` with no check_admin_referer/nonce and no sanitization of the array. An attacker who lures a logged-in admin to a malicious page can POST to the settings screen and overwrite the widget styles with arbitrary values. The widget echoes these values inside inline style attributes; each is wrapped in esc_attr (and the image in esc_url), so the impact is CSS/visual tampering of the widget rather than script execution.

    kwwd-yamtrack-sync-for-wp.php:136-146

    Recommendation

    Add wp_nonce_field + check_admin_referer to the settings form/handler and sanitize each style value against an allow-list (lengths/colors) before update_option.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.