WP Manifestindependent plugin directory
manifest / developer / load-myplugin-files

Load myplugin files WP RegistryLow-severity findings · 1 findingOpen the reportA-

Load the php files in the '/wp-content/myplugin' directory. In that case, the thing whose file name begins with an underscore (example: _example.php) is not included.

by Rocket Martue · github.com/rocket-martue/load-myplugin-files · website

★ 0stars
1.0.1latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rocket-martue/load-myplugin-files/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/rocket-martue/load-myplugin-files ↗

My Custom Functions

  • Load the php files in the '/wp-content/myplugin' directory.
  • In that case, the thing whose file name begins with an underscore (example: _example.php) is not included.
  • You can add custom code without creating a child theme.

カスタム関数

  • '/wp-content/myplugin' ディレクトリの中にある php files を読み込みます。
  • その際、ファイル名がアンダースコアで始まるもの（例：_example.php）は、インクルードしません。
  • 子テーマを作成せずに、カスタムコードを追加することができます。

Releases

2 releases.

Tag
Published
1.0.1 latest
May 11, 2020 6 years ago
1.0.0
Mar 7, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

Load myplugin files 1.0.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.0.1
Findings
1
Worst severity
low
Content hash
e1206909f02fe90a977eae73…

Findings

  • low Loads arbitrary PHP from wp-content/myplugin by design

    unnecessary_attack_surface

    On bootstrap the plugin mkdir's wp-content/myplugin if missing and require_once's every non-underscore .php file found there. Intended drop-in loader; if that directory is writable by a lower-priv process or shared host peer, it becomes persistent code execution. No request-level auth gate (loads unconditionally).

    load-myplugin-files.php:16-28

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →