WP Manifestindependent plugin directory
manifest / media / widen-media

Widen Media WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Search & add Widen digital assets to your WordPress Media Library.

by Masonite · github.com/masonitedoors/widen-media

★ 6stars
2.2kcomposer installs
2.6.7latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/masonitedoors/widen-media/archive/refs/heads/master.zip

On Packagist as masonitedoors/widen-media:

composer require masonitedoors/widen-media
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/masonitedoors/widen-media ↗

Search and add Widen digital assets to your WordPress media library.

This WordPress plugin lets users search for images in Widen and add them to their site's media library. This plugin does not download media from Widen but rather creates a new WordPress media attachment that refers to the Widen asset URL. Some additional Widen metadata is captured and saved to the database on the "Add to Media Library" action. This plugin does not currently support syncing of meta data between Widen & WordPress.

Installation

You can either download a release zip and install via the WordPress plugin installer or via composer.

Composer

composer require masonitedoors/widen-media

Configuration

WordPress

This plugin uses V2 of the Widen API. You will need to define your Widen API access token in wp-config.php.

define( 'WIDEN_MEDIA_ACCESS_TOKEN', 'my-widen-api-token' );

Widen Metadata

Some additional Widen metadata is captured and saved to the database on the Add to Media Library action. This plugin does not currently support syncing of meta data between Widen & WordPress.

Collections

This plugin saves Widen collections under the post type wm_collection in order to provide a way for other themes and plugins to have access to this data without having to directly interact with Widen's API.

Within the main search page under "Add New", users can toggle "collection" when searching Widen. This will return only results that match that collection name.

When searching for a collection, a Save Collection button will be displayed. This button saves the current result page's collection to the metadata of a new post under the wp_collection post type. Note that a collection large than 100 assets will only save the 100 assets on the current results page.

Defining Custom Image Sizes

This plugin ships with some default image sizes however a filter has been included if you wish to change those defined sizes from within another plugin or theme.

Example function defining 2 image sizes:

function filter_defined_image_sizes( $default_image_sizes ) {
  $sizes = [
    'banner-sm' => [
      'label'  => __( 'Small Banner', 'textdomain' ),
      'width'  => 820,
      'height' => 312,
    ],
    'banner-lg' => [
      'label'  => __( 'Large Banner', 'textdomain' ),
      'width'  => 1500,
      'height' => 500,
    ],
  ];

  // Uncomment to append sizes to the plugin's already defined sizes.
  // $sizes = array_merge( $sizes, $default_image_sizes );

  return $sizes;
}
add_filter( 'wm_defined_image_sizes', 'filter_defined_image_sizes', 10, 1 );

Plugin API

This plugin provides some function to allow other plugins to easly interact with Widen data imported into WordPress as well as the Widen API.

wm_get_collections()

Returns an array of collection objects.

wm_get_collection( int $collection_id )

Returns the collection object.

wm_get_asset_fields( int $asset_id )

Returns all the fields from Widen for an asset that exists within the WordPress Media Library.

wm_get_asset_field( int $asset_id, string $key, bool $single = false )

Returns a single field for a Widen asset that exists within the WordPress Media Library.

Releases

16 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
2.6.7 latest
Aug 9, 2022 4 years ago
tag only
—
2.6.6
Jul 21, 2022 4 years ago
tag only
—
2.6.5
Apr 22, 2021 5 years ago
tag only
—
2.6.4
Oct 26, 2020 5 years ago
tag only
—
2.6.3
Oct 23, 2020 6 years ago
tag only
—
2.6.2
Aug 13, 2020 6 years ago
tag only
—
2.6.1
Aug 12, 2020 6 years ago
tag only
—
2.6.0
Aug 5, 2020 6 years ago
tag only
—
2.5.2
Mar 2, 2020 6 years ago
tag only
—
2.5.1
Aug 29, 2019 7 years ago
tag only
—
2.5.0
Aug 9, 2019 7 years ago
tag only
—
2.4.1
Jul 31, 2019 7 years ago
tag only
—
2.4.0
Jul 30, 2019 7 years ago
tag only
—
2.0.2
Jul 18, 2019 7 years ago
tag only
—
2.0.0
Jul 17, 2019 7 years ago
tag only
—
0.0.9
May 7, 2019 7 years ago
widen-mediawiden-media.tar.gz
11
D+ grade

Security

Widen Media 2.6.7 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
2.6.7
Findings
2
Worst severity
high
Content hash
864220d387f979b4bfd93b71…

Findings

  • high Contributor+ SSRF and unauthorized media insert via widen_media_add_asset_to_library

    ssrf

    wp_ajax_widen_media_add_asset_to_library is registered without a nopriv twin, but the callback never calls current_user_can('upload_files') or manage_options. The only gate is check_ajax_referer('widen_media_ajax_request'). That nonce is localized in enqueue_scripts() whenever can_load_scripts() is true: the manage_options search page OR any admin screen whose get_current_screen()->post_type is wm_collection. The CPT uses capability_type=post with map_meta_cap, so a Contributor (edit_posts, no upload_files) can open /wp-admin/edit.php?post_type=wm_collection, read widen_media.ajax_nonce from the page, and POST type=image&url=<arbitrary> to admin-ajax.php. sanitize_text_field does not restrict hosts or schemes. @getimagesize($asset_data['url']) then fetches that URL with PHP stream wrappers (allow_url_fopen), completely bypassing wp_safe_remote_get / wp_http_validate_url (so 169.254.169.254, 127.0.0.1, RFC1918, file:// are reachable). If type=image it also calls get_attachment_sizes(templatedUrl) → Widen::get_size_meta() → another getimagesize per defined size (~10 extra requests). The handler then wp_insert_attachment() with attacker-controlled guid/title/description, update_post_meta widen_media_id / _wp_attached_file / _wp_attachment_image_alt, and stores sizes[].file from the templated URL. Observable consequence: blind SSRF (TCP/HTTP GET from the WordPress host to an attacker-chosen location; response body is not returned because of exit()) plus a Media Library attachment that Contributors are not allowed to create; classic-editor get_image_tag uses handle_image_downsize which emits sizes[].file as img src. Subscriber/customer cannot mint the nonce. Author/Editor can, and for them the SSRF is still extra-capability.

    lib/Admin.php:500-555, 621-628

    Recommendation

    Require current_user_can('manage_options') (or at least upload_files) after the nonce check and wp_send_json_error/wp_die on failure. Do not pass client-supplied URLs to getimagesize(); fetch Widen metadata server-side with wp_safe_remote_get() to api.widencollective.com / embed.widencdn.net only, or allowlist those hosts. Reject non-https, loopback, link-local, and RFC1918 URLs. Keep the nonce.

  • medium Contributor+ can publish wm_collection posts despite create_posts => do_not_allow

    missing_capability

    wp_ajax_widen_media_save_collection is the intended Save Collection control on the manage_options search page, but it only check_ajax_referer('widen_media_ajax_request') and then wp_insert_post({post_type:wm_collection, post_status:publish, post_title: $_POST['query']}) plus update_post_meta($id,'items', $_POST['items']). The CPT registers 'capabilities' => ['create_posts' => 'do_not_allow'], which blocks the admin 'Add New' UI and REST creates; this AJAX path ignores that. The same collections-screen nonce available to Contributor+ (see finding 1) is sufficient. wp_insert_post also fires save_post_wm_collection, whose callback searches the org Widen account (Bearer WIDEN_MEDIA_ACCESS_TOKEN) with the attacker-chosen title as acn:{query} and writes the JSON into items before the AJAX overwrites it. Observable consequence: published wm_collection rows appear under Media > Collections for any editor; create_posts is bypassed; the site token is used for attacker-triggered Widen searches. The CPT is not publicly_queryable, so this is admin-state spam / token confused-deputy rather than a public content inject. Subscriber cannot mint the nonce.

    lib/Admin.php:779-818

    Recommendation

    After the nonce check, require current_user_can('manage_options') (the same cap as the search page that owns the Save Collection button). Do not use wp_insert_post to bypass create_posts => do_not_allow; if Contributors should never create collections, fail closed. Validate items as JSON of expected keys before saving.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →