WP Manifestindependent plugin directory
manifest / social / rw-group-blogs

RW Group Blogs WP RegistryMedium-severity findings · 1 findingOpen the reportB

by Frank Staude · github.com/rpi-virtuell/rw-group-blogs · website

★ 0stars
0.0.3latest · 10 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rpi-virtuell/rw-group-blogs/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/rpi-virtuell/rw-group-blogs ↗
rw-group-blogs

Releases

3 releases.

Tag
Published
0.0.3 latest
Feb 17, 2016 10 years ago
0.0.2
Dec 18, 2015 10 years ago
0.0.1
Dec 18, 2015 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

RW Group Blogs 0.0.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
0.0.3
Findings
1
Worst severity
medium
Content hash
548742fddad584bdba64db93…

Findings

  • medium AJAX refetch_groupblogs missing nonce and capability check

    missing_capability

    wp_ajax_refetch_groupblogs calls fetch_group_feeds($_POST['group_id']) with no nonce or capability verification. Any logged-in user can force feed refreshes for arbitrary group IDs (resource abuse / SSRF against configured feed URLs).

    inc/RW_Group_Blogs_Core.php:231-233

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →