WP Manifestindependent plugin directory
manifest / admin / blog-tutor-support

NerdPress Support WP RegistryMedium-severity findings · 1 findingOpen the reportB

Custom Support Plugin for NerdPress Clients

by NerdPress · github.com/nerdpressteam/blog-tutor-support

★ 5stars
2.4latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/nerdpressteam/blog-tutor-support/archive/refs/heads/main.zip
Updates itself. It ships its own updater, so new versions appear under Dashboard → Updates.
Readme github.com/nerdpressteam/blog-tutor-support ↗

A custom plugin for NerdPress clients.

Description

Our WordPress Support Plans let you stop wasting time on tedious tech tasks so you can focus on what you love.

Releases

Newest 25 of 60 recorded releases.

Tag
Published
2.4 latest
Aug 28, 2024 2 years ago
2.3.2
May 22, 2024 2 years ago
2.3.1
May 9, 2024 2 years ago
2.3
Mar 28, 2024 2 years ago
2.2
Dec 19, 2023 2 years ago
2.1.1
Oct 31, 2023 2 years ago
2.1
Oct 25, 2023 2 years ago
2.0.3
May 1, 2023 3 years ago
2.0.2
Apr 25, 2023 3 years ago
2.0.1
Apr 24, 2023 3 years ago
2.0
Apr 18, 2023 3 years ago
1.5.1
Nov 7, 2022 3 years ago
1.5
Oct 24, 2022 3 years ago
1.4.1
Sep 20, 2022 4 years ago
1.4
Aug 29, 2022 4 years ago
1.3.1
Jul 6, 2022 4 years ago
1.3
Jul 5, 2022 4 years ago
1.2
Sep 1, 2021 5 years ago
1.1
Aug 17, 2021 5 years ago
1.0.4
Jul 21, 2021 5 years ago
1.0.3
Jul 7, 2021 5 years ago
1.0.2
Jul 7, 2021 5 years ago
1.0.1
Jun 28, 2021 5 years ago
0.9.0
Feb 25, 2021 5 years ago
0.8.4
Feb 12, 2021 5 years ago
All releases on GitHub →

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

NerdPress Support 2.4 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2.4
Findings
1
Worst severity
medium
Content hash
bb4c93a46ac294e76e05208e…

Findings

  • medium Traffic REST route missing permission_callback

    missing_permission_callback

    register_rest_route for /nerdpress/v1/client-display-traffic omits permission_callback. On WordPress 5.5+ this fails closed (access denied) with doing_it_wrong, but the route is clearly intended for the admin widget and should explicitly require a capability. Callback send_request_to_relay attaches the site relay API token server-side.

    includes/class-support-widget.php:186-193

    Recommendation

    Add 'permission_callback' => function() { return current_user_can('manage_options'); } (or the intended NerdPress capability).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →