WP Manifestindependent plugin directory
manifest / ecommerce / servicehub-mvm

ServiceHub MVM WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

ServiceHub MVM is a dynamic multi-vendor service marketplace plugin for WordPress, allowing service providers to list, manage, and sell services. Built with scalability and flexibility in mind, this plugin provides a seamless vendor-customer experience with booking, payments, messaging, and more.

★ 1stars
7release downloads
v1.0.1latest · 5mo ago

Install

Download ServiceHub-MVM.zip From the v1.0.0 release on GitHub, Mar 9, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/murslinshehzad-code/servicehub-mvm/releases/download/v1.0.0/ServiceHub-MVM.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A dynamic multi-vendor service marketplace plugin for WordPress, enabling service providers to list, manage, and sell services — complete with vendor dashboards, bookings, payments, and messaging.


✨ Features

  • 🏪 Multi-vendor support — multiple service providers on one platform
  • 📋 Service listing and management for vendors
  • 📅 Booking system for customers
  • 💳 Payment integration
  • 💬 Messaging between vendors and customers
  • 👤 Custom vendor user role with dedicated dashboard
  • ✅ Admin approval/disapproval system for new vendors
  • 🔍 Advanced service filtering by type, location, and price range
  • 📄 Custom Post Type (service) with archive template
  • 🔐 Vendor login and registration pages (auto-created on activation)
  • 🚫 Admin bar hidden for non-admin users on the frontend

📦 Installation

  1. Upload the plugin folder to /wp-content/plugins/servicehub-mvm
  2. Activate the plugin via WordPress Admin → Plugins
  3. On activation, the plugin will automatically:
    • Create the custom vendor user role
    • Generate vendor login and registration pages
    • Register the service custom post type
    • Flush rewrite rules for clean permalinks

🛠️ How It Works

For Admins

  • Manage vendors from the WordPress admin dashboard
  • Approve or disapprove new vendor registrations
  • View dashboard widgets with platform stats

For Vendors

  • Register and log in via dedicated frontend pages
  • List and manage services from their vendor dashboard
  • Receive bookings and communicate with customers

For Customers

  • Browse all available services via the service archive page
  • Filter services by:
    • Service Type (taxonomy)
    • Service Location (taxonomy)
    • Price Range (min/max)
  • Book services and communicate with vendors

🗂️ Plugin Structure

servicehub-mvm/
├── admin/
│   ├── admin-dashboard-widgets.php
│   └── vendor-approval-handler.php
├── includes/
│   ├── class-servicehub-mvm-init.php
│   ├── class-servicehub-mvm-activator.php
│   └── class-servicehub-mvm-deactivator.php
├── public/
│   ├── class-servicehub-mvm-auth.php
│   └── templates/
│       └── vendor/
│           └── archive-service.php
├── index.php
├── uninstall.php
└── servicehub-mvm.php

⚙️ Compatibility

Requirement Version
WordPress ≥ 5.0
PHP ≥ 7.4

🔧 Key Technical Details

  • Custom Post Type: service with custom archive template
  • Custom Taxonomies: service_type, service_location
  • Custom User Role: vendor
  • Uses pre_get_posts for frontend filtering
  • Activation hooks handle role creation, page creation, CPT registration, and permalink flushing
  • Clean uninstall via uninstall.php

🤝 Contributing

Contributions are welcome! Please open an issue first to discuss what you'd like to change, then submit a pull request.


📄 License

This plugin is licensed under the GPL-2.0 License.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.1 latest
May 31, 2026 5mo ago
tag only
—
Mar 9, 2025 1 year ago
ServiceHub-MVM.zip
7
D+ grade

Security

ServiceHub MVM 1.0.0 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
1.0.0
Findings
3
Worst severity
high
Content hash
485804910426f141b7aea037…

Findings

  • high Vendor Dashboard reachable by any role with 'read' lets Subscribers publish services

    missing_capability

    vendor_menu registers an admin page with capability 'read'. services-add.php only checks is_user_logged_in(), then wp_insert_post with post_status publish for CPT 'service'. Any Subscriber can create published marketplace listings and upload gallery media without a vendor role gate.

    public/dashboard/dashboard-mvm-auth.php:8-20

    Recommendation

    Restrict the menu and all service write paths to a dedicated vendor capability (or the vendor role). Require current_user_can before wp_insert_post/media uploads.

  • high Unauthenticated vendor registration without nonce creates privileged vendor users

    csrf

    handle_vendor_registration on init accepts POST register_button with no wp_verify_nonce or CAPTCHA. It wp_insert_user, assigns role vendor (publish_posts, upload_files, etc.), and wp_handle_upload for profile pictures. Attackers can mass-create vendor accounts or CSRF a logged-in admin into creating one.

    public/class-servicehub-mvm-auth.php:100-201

    Recommendation

    Add wp_nonce_field/wp_verify_nonce, rate-limit/CAPTCHA, and validate uploads with wp_check_filetype_and_ext. Consider requiring admin approval before assigning vendor.

  • medium Profile update and service delete handlers lack nonces (CSRF)

    missing_nonce

    dashboard-mvm-auth.php processes profile_change on include (loaded every request via auth bootstrap) with no nonce — a cross-site POST can change a logged-in user's meta and password (if old password known/forced). services-main.php deletes owned services via POST delete_service without a nonce.

    public/dashboard/dashboard-mvm-auth.php:40-130

    Recommendation

    Verify a nonce tied to the action and require is_user_logged_in before mutating user meta or deleting posts.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.