WP Manifestindependent plugin directory
manifest / seo / wp-turbo-plugin

Yandex turbo feed WP RegistryMedium-severity findings · 1 findingOpen the reportB

Generates optimized Yandex Turbo RSS feeds for lightning-fast mobile reading in Yandex services.

by Aleksey Tikhomirov · github.com/tikhomirov/wp-turbo-plugin

★ 1stars
1.0.2latest · 2 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tikhomirov/wp-turbo-plugin/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
From the readme github.com/tikhomirov/wp-turbo-plugin ↗
wp-turbo-plugin WordPress Plugin for Yandex turbo feed Very simple, very minimal plugin.

Releases

3 releases.

Tag
Published
1.0.2 latest
Apr 27, 2024 2 years ago
1.0.1
Apr 27, 2024 2 years ago
1.0.0
Apr 4, 2024 2 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Yandex turbo feed 1.0.1 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.1
Findings
1
Worst severity
medium
Content hash
e90261bf9cea13879d2ddca1…

Findings

  • medium CSRF: flush_rules and clear_feeds_cache via GET on settings page

    csrf

    Loading options-general.php?page=turbo&flush_rules=true or clear_feeds_cache=true while an admin is logged in runs flush_rules() or deletes feed transients with no nonce or POST. A malicious page can CSRF an admin into flushing rewrites.

    admin.php:37-50

    Recommendation

    Use admin-post handlers with check_admin_referer; do not mutate state on bare GET.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →