WP Manifestindependent plugin directory
manifest / content / pronamic-post-expiration

Pronamic Post Expiration WP RegistryMedium-severity findings · 1 findingOpen the reportB

Easily manage and automate post expiration in WordPress.

by Pronamic · github.com/pronamic/pronamic-post-expiration · website

★ 3stars
8release downloads
≈10active sites
71composer installs
v1.0.1latest · 5mo ago

Install

Download pronamic-post-expiration.1.0.1.zip From the v1.0.1 release on GitHub, May 8, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pronamic/pronamic-post-expiration/releases/download/v1.0.1/pronamic-post-expiration.1.0.1.zip

On Packagist as pronamic/wp-pronamic-post-expiration:

composer require pronamic/wp-pronamic-post-expiration
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/pronamic/pronamic-post-expiration ↗

Easily manage and automate post expiration in WordPress.

WordPress post statuses

Post status Label Link
publish Published wp-includes/post.php#L640-L652
future Scheduled wp-includes/post.php#L654-L666
draft Draft wp-includes/post.php#L668-L681
pending Pending wp-includes/post.php#L683-L696
private Private wp-includes/post.php#L698-L710
trash Trash wp-includes/post.php#L712-L725
auto-draft auto-draft wp-includes/post.php#L727-L735
inherit inherit wp-includes/post.php#L737-L745
request-pending Pending wp-includes/post.php#L747-L760
request-confirmed Confirmed wp-includes/post.php#L762-L775
request-failed Failed wp-includes/post.php#L777-L790
request-completed Completed wp-includes/post.php#L792-L805

Post status pronamic_expired

This plugin registers the post status pronamic_expired.

Post type support

\register_post_type(
    'your_post_type',
    [
        // …
        'supports'           => [
            'title',
            'editor',
            'thumbnail',
            // …
            'pronamic-expiration',
        ],
        // …
    ]
);

Advanced support options

\register_post_type(
    'your_post_type',
    [
        // …
        'supports'           => [
            'title',
            'editor',
            'thumbnail',
            // …
            'pronamic-expiration' => [
                'post_status' => 'pronamic_expired',
                'show_ui'     => true,
                'source'      => 'your-plugin-slug',
            ],
        ],
        // …
    ]
);

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.0.1 latest
May 8, 2026 5mo ago
pronamic-post-expiration.1.0.1.zip
2
v1.0.0
Jan 12, 2026 9mo ago
pronamic-post-expiration.1.0.0.zip
6

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

Pronamic Post Expiration 1.0.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.1
Findings
1
Worst severity
medium
Content hash
0383c964b64c8ad5d88c6432…

Findings

  • medium Contributor can publish unmoderated content via past expiration date

    missing_capability

    The expiration metabox is added whenever post-type support is enabled (settings path sets show_ui true) with no publish_posts check. Plugin::save_post verifies only the pronamic_save_expiration_date nonce and current_user_can('edit_post', $post_id), then writes _pronamic_expiration_date. Contributors have edit_post on their own drafts/pending posts and therefore receive a usable nonce on post.php. maybe_schedule_expiration_event_on_save queues as_schedule_single_action('pronamic_expire_post'). expire_post later calls wp_update_post() with the configured post_status and no capability check (wp_insert_post does not enforce publish_posts for custom statuses). Default status pronamic_expired is registered public => true, so publicly_queryable is true and exclude_from_search is false. A Contributor who sets datetime-local to a past value can make unreviewed content available at the permalink and via the REST posts controller without an Editor/Administrator publishing it. Subscriber/customer cannot reach this path. Author+ can already publish. Impact is a moderation bypass on the contributor's own posts, not RCE or stored XSS (kses still applies).

    psr-4/Plugin.php:175-214

    Recommendation

    Require current_user_can('publish_post', $post_id) (or hide the metabox) before writing expiration meta. In expire_post, do not transition a non-public post into a publicly_queryable status unless the post was already viewable. Consider registering pronamic_expired with public/publicly_queryable false if expiration is meant to take content offline.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →