WP Manifestindependent plugin directory
manifest / ai / yodel-image-wp

Yodel Image WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

★ 0stars
282release downloads
≈10active sites
v1.2.2latest · 1 year ago

Install

Download yodel-image-wp.zip From the v1.2.2 release on GitHub, Jan 15, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/sorensenjg/yodel-image-wp/releases/download/v1.2.2/yodel-image-wp.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Here is a short description of the plugin. This should be no more than 150 characters. No markup here.

Description

This is the long description. No limit, and you can use Markdown (as well as in the following sections).

For backwards compatibility, if this section is missing, the full length of the short description will be used, and Markdown parsed.

A few notes about the sections above:

  • "Contributors" is a comma separated list of wp.org/wp-plugins.org usernames

  • "Tags" is a comma separated list of tags that apply to the plugin

  • "Requires at least" is the lowest version that the plugin will work on

  • "Tested up to" is the highest version that you've successfully used to test the plugin. Note that it might work on higher versions... this is just the highest one you've verified.

  • Stable tag should indicate the Subversion "tag" of the latest stable version, or "trunk," if you use /trunk/ for stable.

    Note that the readme.txt of the stable tag is the one that is considered the defining one for the plugin, so if the /trunk/readme.txt file says that the stable tag is 4.3, then it is /tags/4.3/readme.txt that'll be used for displaying information about the plugin. In this situation, the only thing considered from the trunk readme.txt is the stable tag pointer. Thus, if you develop in trunk, you can update the trunk readme.txt to reflect changes in your in-development version, without having that information incorrectly disclosed about the current stable version that lacks those changes -- as long as the trunk's readme.txt points to the correct stable tag.

    If no stable tag is provided, it is assumed that trunk is stable, but you should specify "trunk" if that's where you put the stable version, in order to eliminate any doubt.

Installation

This section describes how to install the plugin and get it working.

e.g.

  1. Upload yodel-image.php to the /wp-content/plugins/ directory
  2. Activate the plugin through the 'Plugins' menu in WordPress
  3. Place <?php do_action('plugin_name_hook'); ?> in your templates

Frequently Asked Questions

A question that someone might have

An answer to that question.

What about foo bar?

Answer to foo bar dilemma.

Screenshots

  1. This screen shot description corresponds to screenshot-1.(png|jpg|jpeg|gif). Note that the screenshot is taken from the /assets directory or the directory that contains the stable readme.txt (tags or trunk). Screenshots in the /assets directory take precedence. For example, /assets/screenshot-1.png would win over /tags/4.3/screenshot-1.png (or jpg, jpeg, gif).
  2. This is the second screen shot

Changelog

1.0

  • A change since the previous version.
  • Another change.

0.5

  • List versions from most recent at top to oldest at bottom.

Upgrade Notice

1.0

Upgrade notices describe the reason a user should upgrade. No more than 300 characters.

0.5

This version fixes a security related bug. Upgrade immediately.

Arbitrary section

You may provide arbitrary sections, in the same format as the ones above. This may be of use for extremely complicated plugins where more information needs to be conveyed that doesn't fit into the categories of "description" or "installation." Arbitrary sections will be shown below the built-in sections outlined above.

A brief Markdown Example

Ordered list:

  1. Some feature
  2. Another feature
  3. Something else about the plugin

Unordered list:

  • something
  • something else
  • third thing

Here's a link to WordPress and one to Markdown's Syntax Documentation. Titles are optional, naturally.

        "Markdown is what the parser uses to process much of the readme file"

Markdown uses email style notation for blockquotes and I've been told:

Asterisks for emphasis. Double it up for strong.

<?php code(); // goes in backticks ?>

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.2.2 latest
Jan 15, 2025 1 year ago
yodel-image-wp.zip
220
Jan 8, 2025 1 year ago
yodel-image-wp.zip
11
Dec 28, 2024 1 year ago
yodel-image-wp.zip
11
Dec 27, 2024 1 year ago
yodel-image.zip
9
Nov 6, 2024 1 year ago
yodel-image.zip
31

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

Yodel Image 1.2.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.2.2
Findings
1
Worst severity
medium
Content hash
55fa33b1b249a42012faefc7…

Findings

  • medium Yodel API key localized to every wp-admin page for all roles

    information_disclosure

    enqueue_scripts always wp_localize_script()s get_option('yodel_api_key') into yodelImageAdmin.settings.apiKey on admin_enqueue_scripts, with no manage_options (or even is_admin-page) check. Subscribers loading profile.php, and every Author/Editor screen, receive the live Bearer token in page HTML/JS. build/index.js uses that token as Authorization against ${apiUrl}/api/v1/account, /api/v1/services, /api/v1/generate/image, and /api/v1/validate-api-key (https://useyodel.com in production). Observable: view-source of /wp-admin/profile.php as Subscriber contains the site's paid Yodel key; the attacker can generate images and drain credits on the site owner's account without writing options. Combined with the settings AJAX they can also rotate the key.

    admin/class-yodel-image-admin.php:148-169

    Recommendation

    Only enqueue and localize yodelImageAdmin on the plugin settings page (and media frames) for users with manage_options. Never print the raw API key for roles that cannot change it. Prefer a capability-gated REST proxy so the browser never holds the vendor Bearer token.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.