WP Manifestindependent plugin directory
manifest / content / pods-to-acf-migrator

Pods to ACF Migrator WP RegistryLow-severity findings · 1 findingOpen the reportA-

Easily migrate your Pods Custom Post Types (CPT) and fields to Advanced Custom Fields PRO (ACF Pro) using a visual and user-friendly interface. This plugin helps you to convert and export Pods CPT structures and fields as ACF JSON files, ready for sync in ACF Pro.

by Ruben Hadders | Jona zinvolle communicatie · github.com/rhadders/pods-to-acf-migrator · website

★ 1stars
12release downloads
v.1.2latest · 1 year ago

Install

Download pods-acf-migrator.zip From the v.1.2 release on GitHub, May 25, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rhadders/pods-to-acf-migrator/releases/download/v.1.2/pods-acf-migrator.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v.1.2 latest
May 25, 2025 1 year ago
pods-acf-migrator.zip
10
v1.0.0
May 22, 2025 1 year ago
pods-acf-migrator.zip
2
A- grade

Security

Pods to ACF Migrator 1.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.1
Findings
1
Worst severity
low
Content hash
b1334d37557838e706e980b7…

Findings

  • low pods_acf_clear_log AJAX missing nonce

    missing_nonce

    wp_ajax_pods_acf_clear_log checks current_user_can('manage_options') then truncates PODS_ACF_LOG_FILE with no check_ajax_referer/wp_verify_nonce. An admin CSRF could clear the migrator log. Sibling handlers (download/delete/delete_all/deactivate) do verify nonces.

    pods-acf-migrator.php:1332-1337

    Recommendation

    Add check_ajax_referer (or wp_verify_nonce) before truncating the log, consistent with pods_acf_delete_all_json.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →