WP Manifestindependent plugin directory
manifest / users / pmpro-register-helper-admin

Paid Memberships Pro - Register Helper Admin WP RegistryHigh-severity findings · 1 findingOpen the reportC-

User-friendly admin page for Paid Membership Pro Register Helper Add On

by Travis Aaron Wagner · github.com/trvswgnr/pmpro-register-helper-admin · website

★ 1stars
v1.1.3latest · 6 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/trvswgnr/pmpro-register-helper-admin/archive/refs/heads/master.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
From the readme github.com/trvswgnr/pmpro-register-helper-admin ↗
Paid Membership Pro Register Helper Admin This plugin creates a user-friendly interface for the Paid Membership Pro Register Helper Add On. It adds a page to the Paid Membership Pro plugin in the WordPress admin that allows admins to easily create fields which are added to the Membership Checkout and User Profile.

Releases

2 releases.

Tag
Published
v1.1.3 latest
Feb 2, 2020 6 years ago
v1.1.1
Feb 1, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Paid Memberships Pro - Register Helper Admin 1.1.3 · audited by WP Registry

High-severity findings.

1 high
Audited release
1.1.3
Findings
1
Worst severity
high
Content hash
3e4db11d9d3f391534b83607…

Findings

  • high add/delete PMPro custom fields without current_user_can

    missing_capability

    register_pmpro_fields() on init processes add_pmpro_field_submit / delete_pmpro_form_field when nonces verify. add_field_to_db / delete_field_from_db have no capability check. Any authenticated user can mint pmprorha_add_field_nonce / pmprorha_delete_field_nonce and mutate pmpro_custom_account_fields, altering membership checkout fields.

    classes/class-register-helper-admin.php:142-235

    Recommendation

    Require current_user_can('pmpro_dashboard') or manage_options before mutating fields.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →