WP Manifestindependent plugin directory
manifest / integrations / wp-plugin-vodien

Vodien Plugin WP RegistryMedium-severity findings · 2 findingsOpen the reportB

Vodien Wordpress Plugin

by Vodien · github.com/newfold-labs/wp-plugin-vodien · website

★ 0stars
234release downloads
≈50active sites
1.1.1latest · 1mo ago

Install

Download wp-plugin-vodien.zip From the 1.1.1 release on GitHub, Sep 3, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/newfold-labs/wp-plugin-vodien/releases/download/1.1.1/wp-plugin-vodien.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/newfold-labs/wp-plugin-vodien ↗

Vodien Logo

Vodien WordPress Plugin

WordPress plugin that integrates a WordPress site with the Vodien control panel, including performance, security, and update features.

Installation

Find the wp-plugin-vodien.zip asset for your preferred version at: https://github.com/newfold-labs/wp-plugin-vodien/releases/.

Alternatively, check the updater endpoint for the latest version at: https://hiive.cloud/workers/release-api/plugins/newfold-labs/wp-plugin-vodien, this also includes a download link to the latest zip file or use this link to access the latest download: https://hiive.cloud/workers/release-api/plugins/newfold-labs/wp-plugin-vodien/download/.

Releasing Updates

This plugin has version number set in 3 distinct places in 2 files:

  • the plugin header info (wp-plugin-vodien/wp-plugin-vodien.php line 14) - this is used in the plugin php code.
  • the constant VODIEN_PLUGIN_VERSION (wp-plugin-vodien/wp-plugin-vodien.php line 34) - this is used by WordPress.
  • in the package.json version value (wp-plugin-vodien/package.json line 5) this is used by the build step to place the release files within a matching version directory for convenient cache busting. All 3 instances need to be incremented in conjuction with new releases via github tagging. (In a perfect world, we have a runner increment and/or validate this)

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.1 latest
Sep 3, 2026 1mo ago
wp-plugin-vodien.zip
4
1.1.0
Aug 28, 2026 1mo ago
wp-plugin-vodien.zip
3
1.0.2
Apr 16, 2026 6mo ago
wp-plugin-vodien.zip
131
1.0.1
Apr 1, 2026 6mo ago
wp-plugin-vodien.zip
87
1.0.0
Dec 17, 2025 10mo ago
wp-plugin-vodien.zip
9

Active-site estimate ≈50 comes from the median of recent superseded releases. Method.

B grade

Security

Vodien Plugin 1.1.1 · audited by WP Registry

Medium-severity findings.

2 medium
Audited release
1.1.1
Findings
2
Worst severity
medium
Content hash
254207a459f4e836fea72192…

Findings

  • medium Password-security AJAX sends plaintext passwords in GET query strings (including unauthenticated)

    information_disclosure

    wp_ajax_nopriv_sp-is-password-secure reads $_GET['password'] with no nonce or capability check and forwards it to Have I Been Pwned. The bundled frontend script uses wp.ajax.send with type GET, so every keystroke on the password-reset and profile forms puts the candidate password in admin-ajax.php query strings. Unauthenticated visitors on wp-login.php?action=rp and any Subscriber+ on profile screens therefore leak passwords into webserver, CDN, and proxy logs (and Referer if a subsequent request fires). This is not RCE, but it is a concrete credential-exposure path below admin.

    vendor/newfold-labs/wp-module-secure-passwords/secure-passwords.php:245-259

    Recommendation

    Switch the AJAX check to POST, require a nonce, drop nopriv unless the reset form truly needs it, and never put the password in the query string. Prefer HIBP k-anonymity with a SHA-1 prefix only.

  • medium AI REST routes authorized with current_user_can('read') use the site Hiive token

    missing_capability

    All newfold-ai/v1/search routes (search, default, sitegen, homepages, otherpages) use permission_callback check_permission(), which only requires current_user_can('read'). Any Subscriber or Customer can therefore call these endpoints. get_search_results() then posts HiiveConnection::get_auth_token() plus the caller-controlled prompt to the Newfold AI service when the site-level canAccessHelpCenter capability is true — consuming the host's AI quota with a site-scoped token the caller should not wield. SiteGen::generate_site_meta() (same gate) writes nfd-ai-site-gen-* options and, for identifier siteclassification, may wp_insert_post() generated content. Inner SiteCapabilities checks are site-wide flags, not per-user roles, so they do not stop a low-privilege logged-in user on a connected Vodien site.

    vendor/newfold-labs/wp-module-ai/includes/RestApi/AISearchController.php:31-53,219-284

    Recommendation

    Require manage_options (or at least edit_posts / a dedicated capability) on every newfold-ai/v1 route. Do not treat SiteCapabilities as a substitute for current_user_can(). Keep the Hiive token server-side only for admin-initiated jobs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →