WP Manifestindependent plugin directory
manifest / admin / wp-admin-announcement

WP Admin Announcement WP RegistryHigh-severity findings · 3 findingsOpen the reportD+

A plugin to display a custom announcement on the WordPress dashboard for all users.

by Your Name · github.com/thiararapeter/wp-admin-announcement

★ 1stars
1.1.02latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/thiararapeter/wp-admin-announcement/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/thiararapeter/wp-admin-announcement ↗

WP Admin Announcement is a WordPress plugin that allows administrators to display custom announcements on the WordPress dashboard. This plugin is designed to keep users informed about important updates, announcements, and feedback collection directly within their admin panel.

Features

  • Display custom announcements on the WordPress dashboard.
  • Manage announcements through the WordPress admin panel.
  • Collect feedback on announcements from users.
  • Customize the appearance and settings of announcements.

Installation

  1. Download the Plugin: Download the plugin from the WordPress plugin repository or the provided link.

  2. Upload to WordPress: Navigate to your WordPress admin panel, go to Plugins > Add New > Upload Plugin. Choose the downloaded plugin file and click Install Now.

  3. Activate the Plugin: After the plugin is uploaded, activate it by clicking the 'Activate Plugin' link.

Usage

After installation and activation, follow these steps to use the plugin:

  1. Access the Admin Announcement Panel: Navigate to 'WP Admin Announcement' in the admin menu to access the plugin settings and features.

  2. Create and Manage Announcements:

    • Go to WP Admin Announcement > Settings to configure the announcement settings.
    • Use the main admin page to create new announcements and manage existing ones.

  3. View Announcements: Announcements will be displayed on the dashboard of all users who have the required access level as specified in the settings.

  4. Feedback Collection: Users can submit feedback on announcements, which can be reviewed in the 'Comments' submenu of the plugin.

Configuration

Configure the plugin to suit your needs:

  • Announcement Visibility: Control who can see announcements based on user roles.
  • Customization: Customize text colors, font types, and more from the Settings submenu.
  • Feedback Management: Review and manage user feedback on announcements.

Contributing

Contributions are what make the open-source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.

  1. Fork the Project
  2. Create your Feature Branch (git checkout -b feature/AmazingFeature)
  3. Commit your Changes (git commit -m 'Add some AmazingFeature')
  4. Push to the Branch (git push origin feature/AmazingFeature)
  5. Open a Pull Request

License

Distributed under the MIT License. See LICENSE for more information.

Contact

Thiarara Peter - @thiararapeter

Project Link: https://github.com/Thiararapeter/WP-Admin-Announcement

WordPress Profile: https://profiles.wordpress.org/thiarara/

Acknowledgements

Releases

2 releases.

Tag
Published
1.1.02 latest
Mar 31, 2024 2 years ago
1.1.01
Mar 31, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

WP Admin Announcement 1.1.02 · audited by WP Registry

High-severity findings.

2 high 1 medium
Audited release
1.1.02
Findings
3
Worst severity
high
Content hash
328462501ce93b5f402bce9d…

Findings

  • high Feedback delete/submit on admin_init without capability or nonce

    missing_capability

    cdn_process_feedback is hooked to admin_init and processes submit_feedback and delete_selected_comments with no current_user_can and no wp_verify_nonce. Any authenticated user who can hit wp-admin (e.g. profile.php as Subscriber) can POST delete_selected_comments and wipe stored feedback, or inject feedback entries. Announcement HTML is also saved from the manage_options page without a nonce (CSRF to store HTML shown unescaped in the dashboard widget).

    wp-admin-announcement.php:101-154

    Recommendation

    Require manage_options (or appropriate caps) and nonces for delete/announcement save; for feedback submit require a nonce and is_user_logged_in.

  • high Announcement content echoed unescaped in dashboard widget (stored XSS via admin CSRF)

    xss_stored

    cdn_dashboard_widget_content echoes cdn_announcement_content without esc_html/wp_kses. Content is written via cdn_admin_page_content using wp_kses_post but without nonce. An admin CSRF can store scriptable HTML shown to all roles configured in cdn_access_level.

    wp-admin-announcement.php:264-266

    Recommendation

    Escape or kses on output; add nonce+capability on save.

  • medium Missing nonce on announcement publish form

    missing_nonce

    Publishing announcement title/content updates options when cdn_announcement_submit is set, with no nonce verification inside the manage_options page callback.

    wp-admin-announcement.php:160-167

    Recommendation

    Add check_admin_referer before updating announcement options.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →