WP Manifestindependent plugin directory
manifest / developer / pf-wp-toolkit

PF WP Toolkit WP RegistryLow-severity findings · 1 findingOpen the reportA-

PublicFunction's WordPress Toolkit Plugin

by Public Function · github.com/mattras82/pf-wp-toolkit · website

★ 0stars
1.0.9latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mattras82/pf-wp-toolkit/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/mattras82/pf-wp-toolkit ↗

PublicFunction WordPress Toolkit Plugin

  • Version 1.2.2

WordPress plugin for adding additional, developer-friendly functionality to a site. This includes JSON config file based functionality for Custom Post Types, Metaboxes, Theme Customizer, and more.

Releases

7 releases.

Tag
Published
1.0.9 latest
Aug 17, 2021 5 years ago
1.0.8
Mar 31, 2021 5 years ago
1.0.7
May 22, 2020 6 years ago
1.0.6
May 17, 2020 6 years ago
1.0.5
Apr 27, 2020 6 years ago
1.0.4
Jan 13, 2020 6 years ago
1.0.3
Jan 13, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

PF WP Toolkit 1.0.9 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.0.9
Findings
1
Worst severity
low
Content hash
84be527b982a4af46539c0e2…

Findings

  • low Unauthenticated REST access to metaboxer/customizer options

    information_disclosure

    pf_rest/v1 metaboxer and customizer endpoints use permission_callback __return_true. GET returns theme-configured metabox fields and customizer options. Read-only; typically frontend theme config. Low information disclosure.

    lib/Metaboxer/Metaboxer.php:45-52

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →