WP Manifestindependent plugin directory
manifest / developer / raiser-wp

Raiser WP WP RegistryMedium-severity findings · 1 findingOpen the reportB

Raiser WP is a framework to assist with developing custom WordPress themes.

by raiserweb.com · github.com/reynoldspaul/raiser-wp · website

★ 1stars
1.0.9latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/reynoldspaul/raiser-wp/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/reynoldspaul/raiser-wp ↗
Raiser WP Raiser WP is a WordPress plugin to assist with developing custom WordPress themes. Getting Started Prerequisites Installing - Download the latest release source code zip, and upload to your WordPress plugins directory. - Activate the plugin in your WordPress admin. Documentation Visit our documentation site) to get started Updates All plugin updates will be available to download via your WordPress plugin admin page. License This project is licensed under the MIT License - see the LICENSE.md file for details. Acknowledgments Thanks to Andy White at whoisandywhite for continued development support. Thanks to Advanced Custom Fields for a great WordPress plugin. Built With Plugin Update Checker - This is a custom update checker library for WordPress plugins and themes. Console Component - The Console component eases the creation of beautiful and testable command line interfaces.

Releases

9 releases.

Tag
Published
1.0.9 latest
Sep 15, 2020 6 years ago
1.0.8
Sep 4, 2020 6 years ago
1.0.7
Aug 27, 2020 6 years ago
1.0.6
Aug 17, 2020 6 years ago
1.0.5
Aug 17, 2020 6 years ago
1.0.4
May 27, 2020 6 years ago
1.0.3
May 8, 2020 6 years ago
1.0.2
May 8, 2020 6 years ago
1.0.1
May 8, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Raiser WP 1.0.8 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.8
Findings
1
Worst severity
medium
Content hash
9d473b989a679c2a669b33e8…

Findings

  • medium Theme generator admin_post handlers check nonce but not capability

    missing_capability

    admin_post_raiser_command_* handlers (config/cpt/tax/block/gblock/new_theme) call check_nonce only. The Tools submenu requires manage_options to render the form, but handlers do not re-check current_user_can('manage_options'). CSRF against an admin can scaffold CPTs/themes/config on disk via Symfony console commands.

    framework/generator/Raiser_Generator_Actions.php:29-70

    Recommendation

    Add current_user_can('manage_options') to every admin_post handler before running generator commands.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →