WP Manifestindependent plugin directory
manifest / utilities / geot-maxmind

Geo Maxmind WP RegistryHigh-severity findings · 1 findingOpen the reportC-

Helper plugin to download Maxmind database automatically for Geotargeting Pro plugin

by Timersys · github.com/timersys/geot-maxmind · website

★ 0stars
1.0.2latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/timersys/geot-maxmind/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/timersys/geot-maxmind ↗

WordPress plugin built for GeotargetingWP subscription users that will download and update Maxmind Geolite 2 database automatically.

Installation

Like any other WordPress plugin, upload zip and activate using wp-admin plugins page.

Settings

No settings are needed for GeotargetingWP users. Simple install and activate and it will work.

If you want to change database or local path use the following filters:

self::$url_maxmind_db = apply_filters( 'geotmax/url_external', 'http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.tar.gz' );

self::$path_maxmind_geo = apply_filters( 'geotmax/path_local', $path_upload['basedir'] . '/geot_plugin/GeoLite2-City.mmdb' );

Requirements

  • PHP >= 5.4
  • WordPress 3.6

Releases

3 releases.

Tag
Published
1.0.2 latest
Mar 20, 2020 6 years ago
1.0.1.1
Jan 7, 2020 6 years ago
1.0.0
Aug 15, 2018 8 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Geo Maxmind 1.0.2 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.0.2
Findings
1
Worst severity
high
Content hash
2d6379131f0b940e33da26aa…

Findings

  • high Hardcoded MaxMind license key in plugin source

    hardcoded_credentials

    GeoLite2 download URL embeds license_key=O9DRmIuDxZllcBX2 in plaintext. Key can be extracted and abused/revoked; also ties all installs to one shared quota.

    includes/class-geot-maxmind.php:38-38

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →