WP Manifestindependent plugin directory
manifest / social / right-report

Right Report WP RegistryMedium-severity findings · 1 findingOpen the reportB

by Right Report · github.com/tylerjohnsondesign/right-report · website

★ 0stars
1.0.6latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/tylerjohnsondesign/right-report/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Releases

7 releases.

Tag
Published
1.0.6 latest
Sep 2, 2021 5 years ago
1.0.5
Jul 9, 2021 5 years ago
1.0.4
Jul 9, 2021 5 years ago
1.0.3
Jul 6, 2021 5 years ago
1.0.2
Jul 6, 2021 5 years ago
1.0.1
Jul 6, 2021 5 years ago
1.0.0
Jul 6, 2021 5 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Right Report 1.0.5 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.5
Findings
1
Worst severity
medium
Content hash
9abeca0afac102e348681d4c…

Findings

  • medium Missing capability/nonce on rr_create_customer AJAX

    missing_capability

    wp_ajax_rr_create_customer posts form data to remote API and update_option('rr_user', password plaintext) with no current_user_can or nonce. Any logged-in user can trigger and overwrite stored credentials. Also stores remote password in wp_options.

    admin/class-customer.php:45-100

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →