WP Manifestindependent plugin directory
manifest / developer / presstest-companion-plugin

Presstest Companion WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

A plugin to integrate with subscriptions and talk to the testing server (linode) to execute tests, output reports and provide test configuration

★ 0stars
18release downloads
1.2.0latest · 1mo ago

Install

Download presstest-companion.zip From the 1.2.0 release on GitHub, Aug 26, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pie/presstest-companion-plugin/releases/download/1.2.0/presstest-companion.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

WordPress plugin that connects a site to the Presstest automated browser testing service. It provides an admin interface for selecting and running test suites, viewing results, and managing connection settings.

How it works

  1. An administrator opens the Presstest admin page and selects one or more test suites to run
  2. The plugin POSTs a job request to the Presstest server (api.presstest.io) via its own REST API, keeping the API key server-side
  3. The Presstest server queues the job, runs it in a Playwright container, and POSTs the JSON results back to this site's REST endpoint (/wp-json/presstest-companion/v1/report)
  4. The callback is authenticated with a per-site secret token generated on plugin activation (X-Presstest-Token)
  5. Results are stored in the database and displayed in the Reports tab

Settings

Setting Description
API Key The PRESSTEST_API_KEY value from the Presstest server's .env file
Report URL Auto-generated — the Presstest server posts results here
Report Token Auto-generated on activation — authenticates the results callback

Adding test suites

Test suites are defined in two places that must stay in sync:

1. The Presstest server (all-tests/ directory)

Each suite is a directory inside all-tests/ on the Presstest server containing one or more _test.js Playwright test files:

all-tests/
  wordpress-core/       ← suite directory name
    login_test.js
  woocommerce-core/
    checkout_test.js
  my-new-suite/         ← add a new directory here
    my_test.js

See the Presstest server README for full details on writing tests.

2. This plugin (src/apps/presstest-app/data/tests.js)

Each entry in the tests array corresponds to a directory on the server. The value must exactly match the directory name:

export const tests = [
    {
        name:  'WordPress Core',   // display label shown in the UI
        value: 'wordpress-core',   // must match the all-tests/ directory name
    },
    {
        name:  'My New Suite',
        value: 'my-new-suite',     // must match all-tests/my-new-suite/
    },
];

After editing tests.js, deploy the plugin for the new suite to appear in the Run Tests tab.

Releases

9 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.2.0 latest
Aug 26, 2026 1mo ago
presstest-companion.zip
7
Aug 18, 2026 2mo ago
presstest-companion.zip
3
Jun 10, 2026 4mo ago
presstest-companion.zip
2
May 5, 2026 5mo ago
presstest-companion.zip
2
May 5, 2026 5mo ago
presstest-companion.zip
3
May 5, 2026 5mo ago
tag only
—
May 5, 2026 5mo ago
presstest-companion.zip
0
May 5, 2026 5mo ago
presstest-companion.zip
1
May 5, 2026 5mo ago
presstest-companion.zip
0
D+ grade

Security

Presstest Companion 1.2.0 · audited by WP Registry

High-severity findings.

3 high
Audited release
1.2.0
Findings
3
Worst severity
high
Content hash
b8ae522255e92b4d37ef4465…

Findings

  • high Any logged-in user can trigger Presstest runs using site API credentials

    missing_capability

    REST POST /presstest-companion/v1/run/ permission_callback is only is_user_logged_in(). Subscribers can supply arbitrary validated URLs/tests/browsers; dispatch_presstest_request sends the site's stored API key server-side, enabling quota burn and forcing remote browser tests against attacker-chosen URLs.

    includes/api/endpoints.php:34-64

    Recommendation

    Require manage_options (or a dedicated cap) on run/; rate-limit per user.

  • high Any logged-in user can list all Presstest reports

    information_disclosure

    GET /reports/ only checks is_user_logged_in(), and get_reports() SELECTs all rows from wp_presstest_reports with no user ownership filter despite the docblock claiming per-user scoping. Subscribers can read every stored report body.

    includes/api/callbacks.php:175-183

    Recommendation

    Require manage_options or filter reports by current user ownership.

  • high Any logged-in user can delete arbitrary Presstest reports

    missing_capability

    DELETE /reports/{id} permission_callback is is_user_logged_in() only; delete_report() deletes by id with no ownership check. A Subscriber can wipe all reports.

    includes/api/endpoints.php:130-155

    Recommendation

    Require manage_options or verify report ownership before delete.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.