WP Manifestindependent plugin directory
manifest / users / wordpress-customer-data

Customer Data WP RegistryHigh-severity findings · 1 findingOpen the reportC-

WordPress plugin allowing visitor to manage documents.

by @holyhope · github.com/natbienetre/wordpress-customer-data · website

★ 0stars
v1.0.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/natbienetre/wordpress-customer-data/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/natbienetre/wordpress-customer-data ↗

WordPress plugin allowing visitor to manage documents.

Releases

8 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.0 latest
Jun 20, 2025 1 year ago
visitor-filesystem-1.0.0.tar.gz +1 asset
0
visitor-filesystem-1.0.0.tar.gz0
visitor-filesystem.tar.gz0
automator-workflow-20250620-092438
Jun 20, 2025 1 year ago
automator-workflow-20250620-092438.tar.gz
0
automator-workflow-20250619-155811
Jun 19, 2025 1 year ago
automator-workflow-20250619-155811.tar.gz
6
automator-workflow-20250619-111926
Jun 19, 2025 1 year ago
automator-workflow-20250619-111926.tar.gz
1
automator-workflow-20250619-105427
Jun 19, 2025 1 year ago
automator-workflow-20250619-105427.tar.gz
1
automator-workflow-20250619-102957
Jun 19, 2025 1 year ago
automator-workflow-20250619-102957.tar.gz
1
automator-workflow-20250619-090630
Jun 19, 2025 1 year ago
automator-workflow-20250619-090630.tar.gz
1
automator-workflow-20250619-085728
Jun 19, 2025 1 year ago
automator-workflow-20250619-085728.tar.gz
1
C- grade

Security

Customer Data 1.0.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.1
Findings
1
Worst severity
high
Content hash
18091621de23f09fd6f477ac…

Findings

  • high Missing capability on admin_post key management handlers

    missing_capability

    admin_create_key, admin_delete_key, and admin_set_main_key verify wp_verify_nonce only. Settings UI requires manage_options, but admin_post_* handlers do not call current_user_can. Any authenticated user can mint a valid nonce for the action names and create/delete/rotate customer-data cryptographic keys stored in options.

    classes/class-keyset.php:154-220

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →