WP Manifestindependent plugin directory
manifest / utilities / gmucf-utilities

GMUCF Utilities WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Feature and utility plugin for the GMUCF WordPress site.

★ 0stars
1composer installs
v1.0.4latest · 3 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/ucf/gmucf-utilities/archive/refs/heads/master.zip

On Packagist as ucf/gmucf-utilities:

composer require ucf/gmucf-utilities
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
GMUCF Utilities # Feature and utility plugin for the GMUCF WordPress site. Description ## Includes features and functionality for the GMUCF WordPress site that are otherwise not suitable for inclusion in the GMUCF Theme. Installation Requirements ## This plugin is developed and tested against WordPress 5.3+ and PHP 7.3+. Theme ### This plugin is intended for use only with the GMUCF Theme. Required plugins ### These plugins must be activated for GMUCF-Utilities to function properly. Advanced Custom Fields PRO UCF Email Editor Plugin Recommended Plugins ### These plugins are not technically required for this plugin to function normally, but are generally expected to be installed for full functionality of the GMUCF site: WP Mail SMTP (for Email CPT instant sends) Changelog ## 1.0.4 ### Enhancements: Added composer file. 1.0.3 ### Enhancements: - Modified email "preview" nomenclature throughout the plugin to more clearly define them as "tests" 1.0.2 ### Bug Fixes: - Made sure the email preview button only shows up for emails. - Fixed/cleaned up some instant send related logic. Enhancements: - Updated preview list retrieval logic to ensure lists of preview recipients a

Releases

5 releases.

Tag
Published
v1.0.4 latest
Mar 21, 2023 3 years ago
Sep 25, 2020 6 years ago
Jul 10, 2020 6 years ago
Jun 23, 2020 6 years ago
Jun 15, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

GMUCF Utilities 1.0.4 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.4
Findings
1
Worst severity
medium
Content hash
5442af66ba5d30498c601766…

Findings

  • medium AJAX instant-send lacks nonce and capability check

    missing_capability

    wp_ajax_instant-send (instant_send_ajax) accepts any authenticated user's POST with only post_id. No wp_verify_nonce/check_ajax_referer and no current_user_can. A Subscriber (or any logged-in role) can trigger instant_send() which emails test HTML of a ucf-email post to configured preview recipients / requester. Impact is unauthorized use of the site mailer for test blasts, not RCE or privilege escalation.

    includes/email-send-functions.php:173-187

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.