WP Manifestindependent plugin directory
manifest / i18n / wordpress-openai-translation

OpenAI Translation WP RegistryMedium-severity findings · 1 findingOpen the reportB

A Wordpress plugin that uses OpenAI to translate posts and pages

by Maxime Nicole · github.com/mnicole90/wordpress-openai-translation

★ 8stars
3composer installs
v1.1.0latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/mnicole90/wordpress-openai-translation/archive/refs/heads/main.zip

On Packagist as mnicole90/wordpress-openai-translation:

composer require mnicole90/wordpress-openai-translation
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/mnicole90/wordpress-openai-translation ↗

OpenAI Translation plugin for Wordpress

This plugin uses the OpenAI API to translate your posts and pages into other languages.

This plugin requires PHP 8.1 or greater to run.

Current version: 1.1.0

Installation

  1. Download the plugin into your wp-content/plugins directory.
  2. Activate the plugin in your Wordpress admin panel.

Configuration

You have the choice to configure the plugin:

  1. Add the environment variable OPENAI_SECRET with your OpenAI API secret key.
  2. Configure the plugin in the "OpenAI Translation" of the "Settings" section of your Wordpress admin panel.

Using SymfonyLocaleValidator component

If you want to use the Symfony Locale Validator, in your terminal run composer install in the plugin directory and set the environment variable OPENAI_TRANSLATION_VALIDATORto symfony or configure it in the plugin settings page.

Usage

  1. Go on the page or post you want to translate.
  2. Click on the "Translate" button in the top right corner.
  3. Click on the language you want to translate to.
  4. Wait for the translation to be generated.
  5. Click on the "Save" button to save the translation.

Authors

License

Copyright 2023 Maxime Nicole

Licensed under the MIT License: http://opensource.org/licenses/MIT

Releases

2 releases.

Tag
Published
v1.1.0 latest
May 9, 2023 3 years ago
v1.0.0
May 6, 2023 3 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

OpenAI Translation 1.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.0
Findings
1
Worst severity
medium
Content hash
192ccaf57a5ba09a77fff3da…

Findings

  • medium Contributor-level users can consume the site-wide paid OpenAI account

    missing_capability

    The translation REST permission callback accepts edit_posts OR edit_pages. WordPress Contributors have edit_posts, so they can call the endpoint directly even though the editor assets are not shown to them, submit arbitrary translation payloads, and repeatedly consume the administrator-configured OpenAI API quota and billing allowance.

    src/Wordpress/Endpoints.php:23-55

    Recommendation

    Require edit_others_posts or manage_options (or a dedicated translation capability), verify that the caller may edit the specific source post, and add per-user rate and payload-size limits.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →