WP Manifestindependent plugin directory
manifest / integrations / wp-plugin-bigrock

BigRock Plugin WP Registry grade A-. Low-severity findings · 1 findingWP RegistryLow-severity findings · 1 findingOpen the reportA-

WordPress plugin that integrates your WordPress site with the Orderbox brands control panel, including performance, security, and update features.

★ 0stars
22release downloads
1.1.0latest · 1mo ago

Install

Download wp-plugin-bigrock.zip From the 1.1.0 release on GitHub, Sep 2, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/newfold-labs/wp-plugin-bigrock/releases/download/1.1.0/wp-plugin-bigrock.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Bigrock Logo

Bigrock WordPress Plugin

WordPress plugin that integrates a WordPress site with the Bigrock control panel, including performance, security, and update features.

Installation

Find the wp-plugin-bigrock.zip asset for your preferred version at: https://github.com/newfold-labs/wp-plugin-bigrock/releases/.

Alternatively, check the updater endpoint for the latest version at: https://hiive.cloud/workers/release-api/plugins/newfold-labs/wp-plugin-bigrock, this also includes a download link to the latest zip file or use this link to access the latest download: https://hiive.cloud/workers/release-api/plugins/newfold-labs/wp-plugin-bigrock/download/.

Releasing Updates

This plugin has version number set in 3 distinct places in 2 files:

  • the plugin header info (wp-plugin-bigrock/wp-plugin-bigrock.php line 14) - this is used in the plugin php code.
  • the constant BIGROCK_PLUGIN_VERSION (wp-plugin-bigrock/wp-plugin-bigrock.php line 34) - this is used by WordPress.
  • in the package.json version value (wp-plugin-bigrock/package.json line 5) this is used by the build step to place the release files within a matching version directory for convenient cache busting. All 3 instances need to be incremented in conjuction with new releases via github tagging. (In a perfect world, we have a runner increment and/or validate this)

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Sep 2, 2026 1mo ago
wp-plugin-bigrock.zip
7
Aug 31, 2026 1mo ago
wp-plugin-bigrock.zip
1
Jul 8, 2026 3mo ago
wp-plugin-bigrock.zip
2
Feb 26, 2026 7mo ago
wp-plugin-bigrock.zip
10
Feb 18, 2026 8mo ago
wp-plugin-bigrock.zip
2
A- grade

Security

BigRock Plugin 1.1.0 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.1.0
Findings
1
Worst severity
low
Content hash
50916c83c7f4a5b9dc214180…

Findings

  • low Public Hiive/data verify endpoints expose token validation oracle

    unnecessary_attack_surface

    newfold-data verify REST and wp_ajax_nopriv_nfd-hiive-verify accept a token and return validity against a one-time transient. Expected for host provisioning but expands unauthenticated surface.

    vendor/newfold-labs/wp-module-data/includes/API/Verify.php:59-62

    Recommendation

    Rate-limit and bind tokens to requesting IP; ensure tokens are single-use high-entropy.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.