WP Manifestindependent plugin directory
manifest / integrations / chiral-connector

Chiral Connector WP RegistryMedium-severity findings · 3 findingsOpen the reportB-

Client of WP Chiral Network, which enables a Wordpress site to join a cross-site network of related articles.

by 评论尸(Pls) · github.com/pls-1q43/chiral-connector · website

★ 2stars
v1.2.2latest · 4mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pls-1q43/chiral-connector/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/pls-1q43/chiral-connector ↗

中文文档

Connect a WordPress site to a Chiral Hub so its posts can participate in federated cross-site related recommendations.

Chiral Connector is the WordPress node/client plugin for the WP Chiral Network. It syncs selected post metadata to a Chiral Hub, receives Jetpack/WordPress.com-powered related-post recommendations from that Hub, and renders those recommendations on your own post pages.

The official project site describes the goal clearly: let independent blogs build routes between each other without becoming another centralized content platform. See WP Chiral Network and the Connector plugin page.

How It Fits

flowchart LR
    A["Your WordPress post"] --> B["Chiral Connector"]
    B -->|"create/update/delete metadata"| H["Chiral Hub Core"]
    H -->|"chiral_data sync"| J["Jetpack and WordPress.com"]
    A -->|"visitor opens post"| B
    B -->|"AJAX related request"| H
    H -->|"mapped related posts"| B
    B --> C["Related posts block on your article"]

Features

Area Capability
Hub connection Connects to a Chiral Hub with Hub URL, Porter username, and WordPress Application Password.
Automatic sync Syncs public post create/update/delete events to the Hub.
Per-post control Provides a "Send to Chiral?" control so individual posts can opt in or out.
Related display Appends related posts automatically or renders them with [chiral_related_posts].
Cache Caches related-post responses to reduce repeat network calls.
Batch sync Provides a one-click path to sync existing posts after joining a network.
Failure handling Retries failed sync work and exposes admin tools for connection testing and cache clearing.
Hub mode Detects when it is installed on the same site as Chiral Hub Core and avoids cyclic synchronization.
Quit network Requests deletion of node data on the Hub, clears local settings, and deactivates the plugin.

Requirements

  • WordPress 5.2 or later.
  • PHP 7.2 or later.
  • A Chiral Hub running Chiral Hub Core.
  • A chiral_porter user on that Hub.
  • A WordPress Application Password generated for the Porter user.

Your node site does not need Jetpack. Jetpack is required on the Hub because the Hub performs the WordPress.com related-post indexing workflow.

Quick Start

  1. Ask the Hub administrator for:
    • Hub URL, for example https://hub.example.com.
    • Porter username.
    • Application Password for that Porter user.
  2. Install and activate Chiral Connector on your WordPress site.
  3. Open the Chiral Connector settings page.
  4. Fill in the Hub URL, Hub username, and Application Password.
  5. Save settings and use Test Connection. A successful ping confirms the Hub credentials and REST API are reachable.
  6. Configure display options, including related-post count and whether related posts should be appended automatically.
  7. Run Batch Sync All Posts if the site already has existing posts that should join the network.

Display Options

Automatic display appends a related-post container to single post content when related posts are enabled.

Manual placement is available with the shortcode:

[chiral_related_posts count="3"]

The front-end script fills the container asynchronously. The default loading text is:

<div id="chiral-connector-related-posts">Loading related Chiral data...</div>

Hub Credentials

The Application Password must be generated on the Hub account that represents your node. It is not the normal login password. If the Hub administrator allows Porter users to log in, generate it from the WordPress profile page on the Hub. Otherwise, ask the Hub administrator to create it for you.

The display name of the Porter user may be used as the source name shown in related-post cards on other sites.

Data and Privacy Model

  • Chiral Connector only syncs selected post metadata and content needed by the Hub for indexing and recommendations.
  • Your original posts remain on your own WordPress site.
  • The Hub can moderate whether synchronized data participates in the Chiral Network, but it cannot edit your original posts.
  • You can disable sync per post with the "Send to Chiral?" control.
  • Quitting the network asks the Hub to delete your node data, clears local settings, and deactivates the plugin. After quitting, log in to the Hub or contact the Hub administrator to verify removal.

LiteSpeed Cache Note

If the related-post block fails to load on a site using LiteSpeed Cache, configure an ESI exception for the nonce used by this plugin:

chiral_connector_related_posts_nonce

In LiteSpeed Cache, enable ESI and add that nonce handle to the ESI Nonces list.

Troubleshooting

Symptom Check
Test Connection fails Confirm Hub URL includes http:// or https://, credentials are exact, and the Hub REST API is reachable.
Posts do not sync Confirm the connection test passes, the post is public, and "Send to Chiral?" is enabled. Run batch sync for historical posts.
Related posts do not display Confirm related display is enabled, content has synced to the Hub, and Jetpack/WordPress.com has had time to index the Hub data.
Shortcode shows nothing Confirm the post is participating in the network and the shortcode is on a single post/page where scripts are enqueued.
LiteSpeed sites show stale or broken related posts Add the ESI nonce exception described above.
Quit network did not remove everything Confirm directly on the Hub after the local plugin deactivates.

Releases and Updates

The current plugin version is 1.2.1.

This repository is the release source for the plugin update checker bundled in the plugin. The update checker points to the main branch of https://github.com/Pls-1q43/Chiral-Connector.

License

GPL v3 or later. See the GNU GPL v3 license.

Releases

5 releases.

Tag
Published
v1.2.2 latest
May 30, 2026 4mo ago
v1.2.1
May 30, 2026 4mo ago
v1.2.0
Jul 9, 2025 1 year ago
v1.1.1
Jun 16, 2025 1 year ago
v1.1.0
Jun 11, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B- grade

Security

Chiral Connector 1.2.2 · audited by WP Registry

Medium-severity findings.

2 medium 1 low
Audited release
1.2.2
Findings
3
Worst severity
medium
Content hash
51bc46f9baee7a83da143c5f…

Findings

  • medium Admin AJAX handlers lack current_user_can (nonce-only)

    missing_capability

    ajax_test_connection, ajax_trigger_batch_sync, and ajax_clear_cache call check_ajax_referer('chiral_connector_admin_nonce') but never current_user_can('manage_options'). Consequences: attacker with a valid admin nonce (CSRF against a logged-in admin) can force wp_remote requests to attacker-chosen hub_url, schedule batch sync, DELETE related-cache transients, and wp_cache_flush().

    admin/class-chiral-connector-admin.php:533-564,622-655,1143-1162

    Recommendation

    Add current_user_can('manage_options') (or equivalent) immediately after the nonce check on every admin AJAX handler.

  • medium Public node-status REST endpoint mutates options on GET

    missing_auth

    GET /wp-json/chiral-connector/v1/node-status uses permission_callback __return_true. Depending on display_enable it calls update_option('chiral_connector_display_last_disabled') or delete_option(...). Unauthenticated clients can flip this state via a read method.

    includes/class-chiral-connector-core.php:330-379

    Recommendation

    Make node-status read-only (no option writes) and/or require authentication for status that exposes hub_url.

  • low Public node-status discloses hub URL

    information_disclosure

    Unauthenticated node-status response includes hub_url and hub_configured boolean (password not returned).

    includes/class-chiral-connector-core.php:369-377

    Recommendation

    Omit hub_url from public responses or require manage_options.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →