WP Manifestindependent plugin directory
manifest / users / group-builder

Group-Builder WP RegistryHigh-severity findings · 4 findingsOpen the reportD+

Ermöglicht Nutzern, Interesse an Beiträgen zu zeigen und Gruppen zu gründen.

by Joachim Happel · github.com/rpi-virtuell/group-builder

★ 1stars
v.2.2latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rpi-virtuell/group-builder/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/rpi-virtuell/group-builder ↗

Group-Builder WordPress Plugin

Group-Builder is a WordPress plugin that allows you to create groups of users and assign them to a specific group. This plugin is useful for creating a community website where you want to group users based on their interests or activities.

Features

  • Associative posts with interested users
  • Allow interested users, to create a group
  • Allow users to join or leave a group
  • Display group members on the frontend
  • Send notifications to group members

Releases

3 releases.

Tag
Published
v.2.2 latest
Oct 7, 2024 2 years ago
v.2.1
Aug 16, 2024 2 years ago
v.1.0
Aug 14, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Group-Builder 2.1 · audited by WP Registry

High-severity findings.

2 high 1 medium 1 low
Audited release
2.1
Findings
4
Worst severity
high
Content hash
6c6ecc2cb31e27b23609be08…

Findings

  • high Missing nonce on group AJAX handlers enables CSRF

    csrf

    State-changing AJAX actions (show_interest, create_group, leave_group, withdraw_interest, join_group, toggle_join_option, generate_invite_link) perform no wp_verify_nonce/check_ajax_referer. Any site that renders admin-ajax for a logged-in subscriber can be CSRF'd into joining/leaving groups or creating group posts.

    includes/Ajax/GroupBuilderAjax.php:39-241

    Recommendation

    Add check_ajax_referer (or wp_verify_nonce) and verify the current user is allowed to act on the target post/group before mutating meta.

  • high Any logged-in user can toggle group join policy

    missing_capability

    ajax_toggle_join_option updates _join_option on an arbitrary group_id from POST with no membership or capability check and no nonce. A Subscriber can lock/unlock any group.

    includes/Ajax/GroupBuilderAjax.php:214-235

    Recommendation

    Require the user to be a group member (or manage_options) and verify a nonce before updating _join_option.

  • medium Event delete AJAX lacks nonce (CSRF for edit_posts)

    csrf

    delete_event_callback checks current_user_can('edit_posts') but never verifies a nonce, so a Contributor+ session can be CSRF'd into permanently deleting event_post posts.

    includes/Ajax/GroupBuilderAjax.php:325-336

    Recommendation

    Add check_ajax_referer and confirm the user can delete the specific event before wp_delete_post.

  • low Weak invite token generation

    predictable_token

    Invite hashes use md5(uniqid(rand(), true)), which is not cryptographically strong. Tokens are stored in post meta and accepted via ?invite=.

    includes/Traits/GroupBuilderHelperTrait.php:39-45

    Recommendation

    Use wp_generate_password(32,false,false) or random_bytes() and hash_equals when comparing.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →