WP Manifestindependent plugin directory
manifest / utilities / wp-moj-components

WP MoJ Components WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

WordPress plugin that applies common functionality to sites used across the MoJ portfolio.

★ 2stars
3.5.4latest · 3mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ministryofjustice/wp-moj-components/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A plugin to manage commonly used functionality across the MoJ portfolio of WordPress properties.

Why?

  1. Simple and efficient maintenance approach
  2. Enforces a baseline standard.
  3. Centralised repo for common website functions
  4. Time-saving development method due to 'one fix affects all'
  5. Increased website load performance

Components within this plugin attempt to create a baseline standard that all MoJ WP properties can benefit from. With ease of component authoring and maintenance it is the preferred method for global code inclusion.

Current components

  1. Introduce: creates a Dashboard widget containing contact information so stakeholders can get support

  2. Introduce (popup): provides a popup banner to relay administrative information to stakeholders

  3. Multisite: adds support for multisite based environments

  4. Multisite (domain tracker): a non destructive custom domain tracker, provided primarily for the WASM tool.

  5. Security: applies scanning functionality and various security patches

  6. Security (rest-api): prevents access to specified REST API routes

  7. Sitemap: provides auto-generated sitemap functionality and shortcodes

  8. Users: introduces user-switch capability for admins plus monitors inactive users for GDPR

  9. Versions: grants access to WordPress version over API and provides information relating to installed plugin and theme versions


How to install

Require the plugin in your composer.json file and always use the latest version:

"ministryofjustice/wp-moj-components": "*"

Load the plugin in the mu-plugins directory when you run composer update.

How it works

Inside the directory named 'component' are sub-directories that represent individual functionality. These are called 'components'.

Each component is stand-alone and contains its own assets and code. Components load automatically using the composer PSR4 autoloader.

Other conventions include:

  • Asset directory can contain:
    • css/
    • fonts/
    • images/
    • js/
  • Components can store sub-classes in a directory called sub/ for auto-loading

You have access to a Helper class within the component directory that provides solutions to paths and offers an easy way to keep inter-common code and functions organised.

You can access this class and it's methods from any component with the following function call:

Helper()->method()

Adding a component

Prerequisite

Please bear in mind that adding a component will affect every site that uses this plugin.

To ensure best fit and before you begin; can you agree with the following statements?

  1. The component I am writing should be used by all websites
  2. The component will benefit all our users and stakeholders
  3. The component helps solve a general business requirement

Setup

Create your component using the following structure.

Feature.php is the main class in the component namespace that handles all the work

  • component/Feature

  • component/Feature/Feature.php

  • an asset directory for use by this component only

  • component/Feature/assets

  • component/Feature/assets/css

  • component/Feature/assets/fonts

  • component/Feature/assets/images

  • component/Feature/assets/js

  • an autoload sub-directory for assistive functionality

  • component/Feature/sub

  • component/Feature/sub/Class.php

Example: basic component class


<?php

namespace MOJComponents\Feature;

/**
 * A great description about what this feature does
 */
class FeatureClass
{
    public  function __construct()
    {
        $this->actions();
    }

    private function actions()
    {
        // hooks in here
    }

    public function method()
    {
        // do some work
    }

    public function another_method()
    {
        // do some other work
    }
}

Releases

24 releases.

Tag
Published
3.5.4 latest
Jul 16, 2026 3mo ago
Jul 3, 2026 4mo ago
Feb 23, 2022 4 years ago
May 19, 2021 5 years ago
Apr 28, 2021 5 years ago
Aug 14, 2020 6 years ago
Aug 14, 2020 6 years ago
Jul 2, 2020 6 years ago
Jun 30, 2020 6 years ago
Jun 30, 2020 6 years ago
May 19, 2020 6 years ago
Apr 29, 2020 6 years ago
Feb 17, 2020 6 years ago
Feb 17, 2020 6 years ago
Feb 14, 2020 6 years ago
Feb 7, 2020 6 years ago
Nov 12, 2019 6 years ago
Sep 25, 2019 7 years ago
Sep 16, 2019 7 years ago
Aug 30, 2019 7 years ago
Aug 1, 2019 7 years ago
Aug 1, 2019 7 years ago
Aug 1, 2019 7 years ago
Jul 31, 2019 7 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

WP MoJ Components 3.5.4 · audited by WP Registry

Medium-severity findings.

1 medium 1 low
Audited release
3.5.4
Findings
2
Worst severity
medium
Content hash
61a017c742da3dfb15aba3f9…

Findings

  • medium Unauthenticated REST discloses WordPress and plugin versions

    information_disclosure

    register_rest_route for moj/version and moj/plugin-versions sets permission_callback to __return_true. wpVersion returns global $wp_version; pluginVersions returns get_option(moj_plugin_versions), a map of installed plugin text domains to versions. This is unauthenticated information disclosure useful for exploit targeting.

    component/Versions/Versions.php:37-67

    Recommendation

    Restrict permission_callback to manage_options (or an allowlisted monitoring capability/API key); avoid public plugin inventory endpoints.

  • low User switch search AJAX registered for unauthenticated users

    unnecessary_attack_surface

    When user_switch_active is enabled, hooks() registers wp_ajax_nopriv_userswitch_user_search. The handler verifies a nonce that is only printed in the admin bar for roleCanImpersonate users, so practical unauth impact is low, but nopriv registration is unnecessary attack surface and the handler does not require is_user_logged_in before searching users.

    component/Users/UserSwitch.php:58-59,463-510

    Recommendation

    Remove nopriv registration; require manage_options (or roleCanImpersonate) before searching users.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.