WP Manifestindependent plugin directory
manifest / security / rw-sso-rest-auth-client

rw sso REST Auth Client WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

WordPress plugin that provides the client side functionality of a Single Sign On (SSO) Network

by Daniel Reintanz · github.com/rpi-virtuell/rw-sso-rest-auth-client · website

★ 0stars
v1.1.0latest · 4 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/rpi-virtuell/rw-sso-rest-auth-client/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/rpi-virtuell/rw-sso-rest-auth-client ↗

A WordPress plugin that provides the client side functionality of a Single Sign On (SSO) Network

Please Note: This Plugin requires REST Routes provided by the RW-SSO-REST-AUTH-SERVICE Plugin

Installation

Features

Installation

1. Setting the Service Server

The Plugin needs to know where to send its REST Calls. This is achieved by providing an Environmental Variable: KONTO_SERVER

KONTO_SERVER should provide a URL

SetEnv KONTO_SERVER "https://my-wordpress-website.com"

Features

This Plugin alters two Backend areas of a standard WordPress website

1. Login

If a user logs in via WP-Admin the Server will send a REST call to a set Service Server which uses the RW-SSO-REST-AUTH-SERVICE Plugin to verify the login information provided by comparing it with its own User Database.

2. Creating new Users

A new options page will be available under the user tab. This will give users with the right "edit_users" the option to import users from the set Service Server.

Download

RW-SSO-REST-AUTH-SERVICE

Releases

3 releases.

Tag
Published
v1.1.0 latest
Mar 14, 2022 4 years ago
v1.0.1
Feb 25, 2022 4 years ago
v1.0
Feb 25, 2022 4 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

rw sso REST Auth Client 1.1.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
1.1.0
Findings
2
Worst severity
high
Content hash
f98031a54aed9d91e8ed254e…

Findings

  • high Missing capability on invite_user_via_ajax allows arbitrary role user creation

    missing_capability

    invite_user_via_ajax is wp_ajax_* only (authenticated) but performs no current_user_can('edit_users'|'create_users') and no nonce check. POST role is taken from the client and passed to wp_insert_user / add_user_to_blog, so a subscriber can invite/create users as administrator if the remote SSO returns a profile.

    sso-rest-auth-client.php:430-470

  • medium get_users_via_ajax missing capability/nonce

    missing_capability

    get_users_via_ajax proxies search to remote SSO and returns user HTML snippets with no capability or nonce check, exposing remote directory data to any logged-in user.

    sso-rest-auth-client.php:396-425

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →