WP Manifestindependent plugin directory
manifest / content / one-planet

One Planet Living WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

by Sush Kelly · github.com/maxray/one-planet · website

★ 0stars
1.7.1latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/maxray/one-planet/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/maxray/one-planet ↗
HOW TO USE Project setup Compiles and hot-reloads for development Compiles and minifies for production Lints and fixes files Customize configuration See Configuration Reference. State Selected data and app state - ActionPage.vue → ToolsPage.vue (gotoTools): appState SAVED to local storage - ToolsPage.vue → ActionPage.vue (saveSelection): appState SAVED to local storage - ActionPage.vue → ActionPlanPage.vue (gotoActionPlan): appState SAVED to local storage Wordpress - ActionPage.vue → ActionPlanPage.vue (gotoActionPlan): appState SAVED to WordPress User login - stores/userStore.js (login()) : appState CLEARED from local storage - stores/userStore.js (login()) : isAuthenticated SAVED to local storage - stores/userStore.js (login()) : userData SAVED to local storage WordPress - stores/userStore.js (login()): fetchUserData FETCHED data from WorPress User logout - stores/userStore.js (logout()) : appState CLEARED from local storage - stores/userStore.js (logout()) : isAuthenticated CLEARED from local storage - stores/userStore.js (logout()) : userData CLEARED from local storage Email This plugin is currently using smtp.gmail.com for SMTP

Releases

11 releases.

Tag
Published
1.7.1 latest
Feb 14, 2025 1 year ago
1.7.0
Feb 14, 2025 1 year ago
1.6.5
Feb 13, 2025 1 year ago
1.6.3
Feb 12, 2025 1 year ago
1.6.2
Feb 12, 2025 1 year ago
1.6.1
Feb 6, 2025 1 year ago
1.6
Feb 6, 2025 1 year ago
1.5
Feb 6, 2025 1 year ago
1.4
Feb 6, 2025 1 year ago
1.3
Feb 6, 2025 1 year ago
1.2
Feb 6, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

One Planet Living 1.7.1 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.7.1
Findings
2
Worst severity
high
Content hash
9ea7c4aa15fd19025c809772…

Findings

  • high Unauth REST get_user_meta discloses any user's meta

    information_disclosure

    vueapp/v1/get_user_meta is publicly readable and returns get_user_meta for arbitrary user_id/meta_key.

    includes/Api/User.php:89-303

  • medium Public register/login REST with only optional nonce on register

    unnecessary_attack_surface

    vueapp/v1/register and /login use __return_true. Register checks X-WP-Nonce (scrapable by unauth). Login has no nonce and sets auth cookies via wp_signon — intentional for SPA but expands brute-force surface. Flagged as medium attack-surface rather than classic auth bypass.

    includes/Api/User.php:41-215

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →