WP Manifestindependent plugin directory
manifest / utilities / fintech-profiler

Fintech Profiler WP Registry grade D+. High-severity findings · 3 findingsWP RegistryHigh-severity findings · 3 findingsOpen the reportD+

This is a simple plugin to handle Fintach Profiler.

★ 0stars
1.017latest · 11mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rajan-lama/fintech-profiler/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Plugin Name

Here is a short description of the plugin. This should be no more than 150 characters. No markup here.

Description

This is the long description. No limit, and you can use Markdown (as well as in the following sections).

For backwards compatibility, if this section is missing, the full length of the short description will be used, and Markdown parsed.

A few notes about the sections above:

  • "Contributors" is a comma separated list of wp.org/wp-plugins.org usernames

  • "Tags" is a comma separated list of tags that apply to the plugin

  • "Requires at least" is the lowest version that the plugin will work on

  • "Tested up to" is the highest version that you've successfully used to test the plugin. Note that it might work on higher versions... this is just the highest one you've verified.

  • Stable tag should indicate the Subversion "tag" of the latest stable version, or "trunk," if you use /trunk/ for stable.

    Note that the readme.txt of the stable tag is the one that is considered the defining one for the plugin, so if the /trunk/readme.txt file says that the stable tag is 4.3, then it is /tags/4.3/readme.txt that'll be used for displaying information about the plugin. In this situation, the only thing considered from the trunk readme.txt is the stable tag pointer. Thus, if you develop in trunk, you can update the trunk readme.txt to reflect changes in your in-development version, without having that information incorrectly disclosed about the current stable version that lacks those changes -- as long as the trunk's readme.txt points to the correct stable tag.

    If no stable tag is provided, it is assumed that trunk is stable, but you should specify "trunk" if that's where you put the stable version, in order to eliminate any doubt.

Installation

This section describes how to install the plugin and get it working.

e.g.

  1. Upload fintech-profiler.php to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Place <?php do_action('plugin_name_hook'); ?> in your templates

Frequently Asked Questions

A question that someone might have

An answer to that question.

What about foo bar?

Answer to foo bar dilemma.

Screenshots

  1. This screen shot description corresponds to screenshot-1.(png|jpg|jpeg|gif). Note that the screenshot is taken from the /assets directory or the directory that contains the stable readme.txt (tags or trunk). Screenshots in the /assets directory take precedence. For example, /assets/screenshot-1.png would win over /tags/4.3/screenshot-1.png (or jpg, jpeg, gif).
  2. This is the second screen shot

Changelog

1.0

  • A change since the previous version.
  • Another change.

0.5

  • List versions from most recent at top to oldest at bottom.

Upgrade Notice

1.0

Upgrade notices describe the reason a user should upgrade. No more than 300 characters.

0.5

This version fixes a security related bug. Upgrade immediately.

Arbitrary section

You may provide arbitrary sections, in the same format as the ones above. This may be of use for extremely complicated plugins where more information needs to be conveyed that doesn't fit into the categories of "description" or "installation." Arbitrary sections will be shown below the built-in sections outlined above.

A brief Markdown Example

Ordered list:

  1. Some feature
  2. Another feature
  3. Something else about the plugin

Unordered list:

  • something
  • something else
  • third thing

Here's a link to WordPress and one to Markdown's Syntax Documentation. Titles are optional, naturally.

        "Markdown is what the parser uses to process much of the readme file"

Markdown uses email style notation for blockquotes and I've been told:

Asterisks for emphasis. Double it up for strong.

<?php code(); // goes in backticks ?>

List for Shortcodes

[fintech_logout] [fintech_login]

Releases

12 releases.

Tag
Published
1.017 latest
Nov 4, 2025 11mo ago
Oct 11, 2025 1 year ago
Oct 11, 2025 1 year ago
Oct 9, 2025 1 year ago
Sep 25, 2025 1 year ago
Sep 24, 2025 1 year ago
Sep 24, 2025 1 year ago
Sep 24, 2025 1 year ago
Sep 24, 2025 1 year ago
Sep 23, 2025 1 year ago
Sep 23, 2025 1 year ago
Sep 21, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Fintech Profiler 1.0.17 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
1.0.17
Findings
3
Worst severity
high
Content hash
9326ff2c5eb9c5249b7c7500…

Findings

  • high Unauthenticated company logo upload (nonce only, public nonce)

    handle_company_logo_upload is nopriv-reachable and only checks fp_media_uploader_nonce. That nonce is localized on the public frontend via wp_localize_script('fp-media-uploader'), so anonymous visitors obtain a valid nonce and can upload into the media library.

    includes/helper-functions.php:908-945

  • high Unauthenticated image remove unlinks filesystem paths

    missing_auth

    fp_remove_uploaded_image is nopriv with no auth/nonce. It updates post meta and unlinks a path derived from attacker-controlled image_url under uploads, enabling deletion of uploaded files and gallery meta tampering for any post_id.

    includes/helper-functions.php:1036-1056

  • medium Unauthenticated gallery order meta update

    fp_update_image_order is nopriv without auth/nonce and writes _company_logo_gallery post meta for arbitrary post_id.

    includes/helper-functions.php:1059-1069

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.