WP Manifestindependent plugin directory
manifest / integrations / technomancer-wp

Technomancer WP WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

Multi-flow WordPress and WooCommerce automation plugin for n8n, Notifuse, and ERPNext.

★ 0stars
5release downloads
v0.1.1latest · 5mo ago

Install

Download technomancer-wp-0.1.1.zip From the v0.1.1 release on GitHub, May 1, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sinappsus-agency/technomancer-wp/releases/download/v0.1.1/technomancer-wp-0.1.1.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Technomancer WP is a WordPress automation plugin that connects WordPress and WooCommerce events to external workflows (n8n), and includes built-in integration modules for Notifuse and ERPNext.

What This Plugin Provides

  • Event-driven automation flows
  • Secured REST endpoints for controlled read/write actions
  • WooCommerce integration hooks and product enhancements
  • Notifuse integration tooling
  • ERPNext integration tooling
  • Delivery logs, replay support, and admin tooling

API Namespace

The REST route namespace is:

  • /wp-json/technomancer-wp/v1

Automated Updates

This plugin uses plugin-update-checker and supports two update modes:

  1. GitHub mode (default)
  2. Metadata JSON mode

Update bootstrap is implemented in src/Core/Updater.php.

Default GitHub Source

  • https://github.com/sinappsus-agency/technomancer-wp/

Updater Filters

add_filter('tmwp_update_metadata_url', static function () {
  return ''; // Optional JSON manifest endpoint.
});

add_filter('tmwp_update_source', static function () {
  return 'https://github.com/sinappsus-agency/technomancer-wp/';
});

add_filter('tmwp_update_branch', static function () {
  return 'main';
});

add_filter('tmwp_update_slug', static function () {
  return 'technomancer-wp';
});

add_filter('tmwp_update_token', static function () {
  return ''; // Required for private repositories.
});

Metadata JSON Example

{
  "name": "Technomancer WP",
  "slug": "technomancer-wp",
  "version": "0.1.1",
  "download_url": "https://updates.example.com/technomancer-wp-0.1.1.zip",
  "requires": "6.0",
  "tested": "6.8",
  "requires_php": "8.0"
}

Automated Release Pipeline

Workflow file:

  • .github/workflows/release-plugin.yml

On push to main, it will:

  1. Check out repository + submodules
  2. Build release ZIP via scripts/build-release.sh
  3. Create or update release tag v{version}
  4. Upload ZIP asset used by update checks

ZIP artifact naming:

  • dist/technomancer-wp-{version}.zip

Release Process

  1. Bump plugin header Version in technomancer-wp.php
  2. Commit and push to main
  3. Confirm workflow success in GitHub Actions
  4. Confirm release v{version} includes ZIP asset

If Version is not increased, installed sites will not detect a newer update.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v0.1.1 latest
May 1, 2026 5mo ago
technomancer-wp-0.1.1.zip
4
May 1, 2026 5mo ago
technomancer-wp-0.1.0.zip +1 asset
1
technomancer-wp-0.1.0.zip1
sinappsus-n8n-connector-0.1.0.zip0
C- grade

Security

Technomancer WP 0.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
0.1.1
Findings
1
Worst severity
high
Content hash
708f2833c6c4752a2d4a471f…

Findings

  • high Empty API token authorizes n8n REST write/read endpoints

    auth_bypass

    RequestAuthorizer compares Authorization to 'Bearer ' . $token. If settings api_token is cleared/empty, the required header is exactly 'Bearer ' (Bearer plus a space), which any unauthenticated client can send. authorizeN8nRequest then admits GET entity/search and POST action/meta and action/order-note, allowing arbitrary user/post/order meta updates and customer order notes without a real secret.

    src/Security/RequestAuthorizer.php:24-33

    Recommendation

    Reject authorization when api_token is empty. Require a minimum token length and always enforce HMAC when signing_secret is set. Do not treat an empty bearer as valid.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.