WP Manifestindependent plugin directory
manifest / forms / mct-lead-form

MCT Lead Form WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

A WordPress plugin for MCT for embedding lead forms.

★ 0stars
1.7.1latest · 15d ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/pvtl/mct-lead-form/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

A WordPress plugin for MCT for embedding lead forms.

Installation

1. Go to project root folder

Simply run cd /projects/{project name}

2.

Simply run composer require "pvtl/mct-lead-form": "^1.1".

3. copy & rename .env file

Simply run cp .env.example .env

4. Edit .env file and paste code below, replace values

# MCT Lead Form
MCT_API_HOST='{API HOST URL}'
MCT_API_TOKEN='{API TOKEN}'
MCT_API_BUSINESS_ID={API BUSINESS ID}
MCT_LEAD_FORM_REDIRECT='{WP SLUG THANK YOU PAGE}' ///valuation-thank-you/

5. Edit .env file and paste code below, replace values (@sinc 1.3.7)

5.1 Run cd /projects/{project name}/web/app 5.2 Run mkdir mct-lead-form-logs to create new folder for mct logs


Form templates can be overriden in the theme level

You can copy templates folder and paste it into themes/{theme name}/mct/. If mct folder is missing you need to create one.


Multistep Form

You can copy multisteps form implementation from https://github.com/pvtl/buyyourcar.git.

Important Notes: If ever you are implementing multistep form you need to include the script to the main script. Or if you are having issue with mainmultistep.js file not updating, kindly copy gulp.js line 120 - 139 adjust the code accordingly.


Upgrading

1. Update version number

Update the version number of this plugin from mct-lead-form.php.

2. Push your updates

Make sure you build assets if you made changes to the js
yarn production

3. Create version tag

Create a new tag here https://github.com/pvtl/mct-lead-form/releases/new.

4. Update version number from the wordpress site

The composer.json should use the new version number of this plugin. Run composer update pvtl/mct-lead-form then push your composer lock file.

Releases

9 releases.

Tag
Published
1.7.1 latest
Oct 8, 2026 15d ago
Oct 8, 2026 15d ago
Sep 8, 2026 1mo ago
May 14, 2026 5mo ago
Apr 23, 2026 6mo ago
Mar 3, 2026 7mo ago
Jul 17, 2025 1 year ago
Jul 17, 2025 1 year ago
Jun 3, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

MCT Lead Form 1.5.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.5.0
Findings
1
Worst severity
medium
Content hash
355249c82e884aadf8f1178c…

Findings

  • medium Unauthenticated lead update REST lacks ownership check

    mct/.../leads/(?P<id>\d+) EDITABLE is registered with permission_callback __return_true and explicitly bypasses REST cookie/nonce auth. route_update_lead accepts an arbitrary numeric id and PATCHes vehicle/notes fields to the upstream API with no secret, session, or ownership token. Create is intentional for public forms; update enables IDOR-style tampering of other visitors' leads.

    classes/class-form.php:550-740

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.