WP Manifestindependent plugin directory
manifest / social / instagram-to-wordpress-posts

Instagram to WordPress Posts WP RegistryMedium-severity findings · 1 findingOpen the reportB

Wordpress Plugin "instagram-to-wordpress-posts"

by Sven Grün · github.com/smpx7/instagram-to-wordpress-posts

★ 0stars
v1.9.0latest · 1 year ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/smpx7/instagram-to-wordpress-posts/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/smpx7/instagram-to-wordpress-posts ↗
A plugin to fetch Instagram posts using the Instagram Basic Display API, store them as a custom post type, and provide a settings page. This plugin allows you to fetch Instagram posts and store them as a custom post type in WordPress. 1. Upload the plugin files to the /wp-content/plugins/instagram-to-wordpress-posts directory, or install the plugin through the WordPress plugins screen directly. 2. Activate the plugin through the 'Plugins' screen in WordPress. 3. Use the Settings-Instagram API screen to configure the plugin.

Releases

3 releases.

Tag
Published
v1.9.0 latest
Nov 12, 2024 1 year ago
1.8.4
Sep 13, 2024 2 years ago
1.8.3
Sep 13, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Instagram to WordPress Posts 1.9.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.9.0
Findings
1
Worst severity
medium
Content hash
0aa8bf761bfb45c48b83a112…

Findings

  • medium itwp_manual_fetch AJAX lacks current_user_can

    missing_capability

    ajax_start_fetch/ajax_fetch_next_batch verify nonce only. Nonce is localized on edit.php for instagram_post CPT (any role that can list that CPT) and settings page. Missing manage_options check allows lower-privileged editors with CPT access to trigger imports using the site access token.

    includes/class-itwp-instagram-fetcher.php:45-80

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →