WP Manifestindependent plugin directory
manifest / integrations / rw-distributed-profile-client

RW Distributed Profile Client WP RegistryLow-severity findings · 1 findingOpen the reportA-

by Frank Staude · github.com/rpi-virtuell/rw-distributed-profile-client · website

★ 1stars
0.1.2latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rpi-virtuell/rw-distributed-profile-client/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/rpi-virtuell/rw-distributed-profile-client ↗
rwdistributedprofileclienttranslationpath rwdistributedprofileclientfieldvalue rwdistributedprofileclientfieldFIELDTYPvalue rwdistributedprofileclientinit rwdistributedprofileclientautoloadregister rwdistributedprofileclientautoloadunregister Settingpage: endpoint: e.g. http://example.com/rwprofile/ Answer = 0.1.2 Add URL Fallback = 0.1.1 Added support for WordPress Plugin GitHub updater First version published

Releases

2 releases.

Tag
Published
0.1.2 latest
Aug 23, 2016 10 years ago
0.1.1
Jun 30, 2015 11 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A- grade

Security

RW Distributed Profile Client 0.1.2 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
0.1.2
Findings
1
Worst severity
low
Content hash
c854219c6392bdec48a569a0…

Findings

  • low sslverify disabled on profile sync HTTP requests

    insecure_config

    wp_remote_get to the configured distributed profile endpoint passes sslverify => false, enabling MITM on the sync channel. Response values are maybe_unserialize'd into xprofile fields for the logging-in user.

    inc/RW_Distributed_Profile_Client_Profile.php:22-75

    Recommendation

    Use default sslverify true; avoid unserializing untrusted remote payloads.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →