WP Manifestindependent plugin directory
manifest / updates / markdown-exporter-for-wordpress

Markdown Exporter for WordPress® WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Seamlessly convert your WordPress posts, pages, and custom content types into well-structured Markdown (MD) files. Featuring customizable export settings, support for Advanced Custom Fields (ACF) and Pods, and a real-time progress bar for efficient content management.

★ 31stars
132release downloads
1.1.0latest · 1 year ago

Install

Download markdown-exporter-for-wordpress.zip From the 1.1.0 release on GitHub, Feb 8, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/robertdevore/markdown-exporter-for-wordpress/releases/download/1.1.0/markdown-exporter-for-wordpress.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Markdown Exporter for WordPress® is a free WordPress® plugin that allows you to quickly convert your WordPress® content - posts, pages, and custom content types — into well structured Markdown (MD) files.

Whether you're migrating content, backing up your site, or preparing to switch from WordPress® to a static site generator like Stattic, this plugin provides a customizable and efficient solution.

Table of Contents

Features

  • Comprehensive Export Options: Convert posts, pages, and any custom post types into Markdown files.
  • Customizable Settings: Filter exports by post types, date range, author, post status, and taxonomies.
  • Support for ACF and Pods: Includes Advanced Custom Fields (ACF) and Pods metadata in the export.
  • Real-Time Progress Bar: Monitor the export process with a dynamic progress bar.
  • Export Log: View detailed logs of the export process, including any issues encountered.
  • YAML Front Matter: Generates Markdown files with YAML front matter for easy integration with static site generators.
  • Automatic Updates: Stay up-to-date with the latest features and security patches via GitHub.
  • Parsedown Integration: Converts post content from HTML to Markdown using Parsedown for accurate formatting.

Installation

Prerequisites

  • WordPress® Version: 5.0 or higher
  • PHP Version: 7.0 or higher

Steps

  1. Download the Plugin

    You can download the latest version of the plugin from the GitHub repository.

     git clone https://github.com/robertdevore/markdown-exporter-for-wordpress.git
  2. Upload to WordPress®

    • Via FTP/SFTP:

      • Upload the markdown-exporter-for-wordpress folder to the /wp-content/plugins/ directory.
    • Via WordPress® Admin Dashboard:

      • Navigate to Plugins > Add New > Upload Plugin.
      • Click Choose File and select the .zip file of the plugin.
      • Click Install Now and then Activate.
  3. Activate the Plugin

    After installation, activate the plugin through the Plugins menu in WordPress®.

Usage

  1. Access the Settings Page

    • Navigate to Tools > Markdown Exporter in your WordPress® admin dashboard.
  2. Configure Export Settings

    • Post Types: Select specific post types to include in the export. Leave empty to export all public post types.
    • Date Range: Specify the start and end dates to filter the content by publication date.
    • Author: Choose a specific author to export content from, or select "All Authors".
    • Post Status: Filter by post status (e.g., Published, Draft) or select "All Statuses".
    • Taxonomies: Select specific taxonomies (e.g., Categories, Tags) to include in the export.
  3. Initiate Export

    • Click the Export button to start the export process.
    • Monitor the progress through the real-time progress bar.
  4. Access Exported Files

    • The exported ZIP file will be available in your WordPress® uploads directory.
    • Download and extract the ZIP to access your Markdown files organized by post type and slug.

Frequently Asked Questions

1. Can I export custom fields from Advanced Custom Fields (ACF) or Pods?

Yes, the plugin supports exporting custom fields created with ACF and Pods. All post meta data is included in the YAML front matter of the Markdown files.

2. What happens if the export process fails?

If an error occurs during the export, it will be logged in the Export Log section on the settings page. Ensure that your server has the necessary PHP extensions, such as ZipArchive, enabled.

3. Can I schedule exports to run automatically?

Currently, the plugin does not support scheduled exports. However, you can contribute to the plugin or request this feature by opening an issue on the GitHub repository.

4. Is there a limit to the number of posts I can export?

The export process is designed to handle a large number of posts efficiently. However, server limitations such as memory and execution time may affect the export of extremely large datasets. It's recommended to export in smaller batches using the date range filter if you encounter issues.

5. How can I contribute to the plugin?

Feel free to fork the repository and submit pull requests. For any issues or feature requests, please open an issue on the GitHub repository.

Support

For support, please visit the Support Page or open an issue on the GitHub repository.

Contributing

Contributions are welcome! Please follow these steps:

  1. Fork the Repository

    Click the Fork button on the top right of the repository page.

  2. Clone Your Fork

     git clone https://github.com/robertdevore/markdown-exporter-for-wordpress.git
  3. Create a New Branch

     git checkout -b feature/your-feature-name
  4. Make Your Changes

    Implement your feature or fix the bug.

  5. Commit Your Changes

     git commit -m "Add feature: your-feature-name"
  6. Push to Your Fork

     git push origin feature/your-feature-name
  7. Open a Pull Request

    Navigate to the original repository and open a pull request.

Please ensure your code follows the existing coding standards and includes appropriate documentation and tests.

License

This plugin is licensed under the GNU General Public License v2.0 or later.


Developed by Robert DeVore
Visit robertdevore.com for more information and other projects.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Feb 8, 2025 1 year ago
markdown-exporter-for-wordpress.zip
132
Nov 17, 2024 1 year ago
tag only
—
Nov 14, 2024 1 year ago
tag only
—
C- grade

Security

Markdown Exporter for WordPress® 1.1.0 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.0
Findings
1
Worst severity
high
Content hash
f41847a4a0c9ca3b408f9e81…

Findings

  • high Export ZIP of all content and post meta is stored at a public, guessable uploads URL

    information_disclosure

    MarkdownExporter::export_content builds a ZipArchive on disk at trailingslashit(wp_upload_dir()['path']) . sanitize_title(get_bloginfo('name')) . '_markdown_export_' . date('Y-m-d_H-i-s') . '.zip' and returns that path's public URL to the browser. There is no random token, no .htaccess/deny, no capability check on the subsequent GET, and no unlink after download — archives accumulate under the dated uploads folder indefinitely. The filename is fully determined by the public site title plus a second-resolution timestamp (at most 86400 guesses per day, 3600 per known hour). Each Markdown entry is generate_markdown_content(), which dumps every get_post_meta() value into YAML (the skip for keys starting with '_' is a commented TODO). The settings UI offers Draft/Private post statuses, and the AJAX path accepts any sanitized post_type (not restricted to public types), so a normal export of drafts, private posts, WooCommerce products (_downloadable_files), or a crafted shop_order export lands in a world-readable ZIP. wp_ajax_markdown_export itself only calls check_ajax_referer (no current_user_can('manage_options')); the nonce is only localized on the manage_options Tools page, so Subscriber cannot mint it, but the leftover file is the unauthenticated primitive. Observable: GET /wp-content/uploads/2026/09/{blog-slug}_markdown_export_YYYY-MM-DD_HH-MM-SS.zip as a logged-out client after an admin has used Tools → Markdown Exporter.

    classes/MarkdownExporter.php:323-326,348-366,393-444,488-509

    Recommendation

    Add current_user_can('manage_options') next to the nonce check. Do not persist the archive under a web-reachable uploads URL: stream it from the AJAX handler with Content-Disposition: attachment and delete the temp file, or write it outside the document root with a wp_generate_password() component in the name and a PHP download gated on manage_options. Restrict post_type to an allowlist of public types (or current_user_can('read_post') per row), and skip underscore-prefixed meta unless the admin opts in. Unlink old export ZIPs.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.