WP Manifestindependent plugin directory
manifest / events / wp-movie-announcer

Program Announcer WP RegistryHigh-severity findings · 2 findingsOpen the reportD+

This plugin automatically announces the upcoming weeks program every Saturday as long as there is at least one screening

by Jan Eike Suchard · github.com/unikino-gegenlicht/wp-movie-announcer · website

★ 0stars
9release downloads
v2.2.0latest · 6mo ago

Install

Download wp-movie-announcer.v2.2.0.zip From the v2.2.0 release on GitHub, Apr 26, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/unikino-gegenlicht/wp-movie-announcer/releases/download/v2.2.0/wp-movie-announcer.v2.2.0.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.
Readme github.com/unikino-gegenlicht/wp-movie-announcer ↗

WordPress Movie Announcer

wp-movie-announcer

A plugin for announcing a weekly program summary

License GitHub Issues or Pull Requests

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v2.2.0 latest
Apr 26, 2026 6mo ago
wp-movie-announcer.v2.2.0.zip +1 asset
4
wp-movie-announcer.v2.2.0.zip4
LICENSE0
v2.1.0
Apr 22, 2026 6mo ago
wp-movie-announcer.v2.1.0.zip +1 asset
1
wp-movie-announcer.v2.1.0.zip1
LICENSE0
v2.0.0
Apr 22, 2026 6mo ago
wp-movie-announcer.v2.0.0.zip +1 asset
3
wp-movie-announcer.v2.0.0.zip2
LICENSE1
v1.1.0
Apr 22, 2026 6mo ago
LICENSE +1 asset
0
LICENSE0
wp-movie-announcer.v1.1.0.zip0
v1.0.2
Apr 22, 2026 6mo ago
wp-movie-announcer.v1.0.2.zip +1 asset
3
wp-movie-announcer.v1.0.2.zip2
LICENSE1
D+ grade

Security

Program Announcer 2.1.0 · audited by WP Registry

High-severity findings.

1 high 1 medium
Audited release
2.1.0
Findings
2
Worst severity
high
Content hash
286d3e4b09f4309909d78e39…

Findings

  • high Social publish AJAX missing capability check

    missing_capability

    wp_ajax_wpma_publish_manually verifies check_ajax_referer("wpma_publish_manually") then publishes screening posts to Discord/Mastodon/AT Proto. There is no current_user_can('manage_options') (or similar). Combined with missing CSRF resistance beyond nonce, any session that can present the nonce can trigger outbound posts with the site's social credentials.

    wp-movie-announcer.php:60-82

    Recommendation

    Require current_user_can('manage_options') (or the Meta Box settings capability) after the nonce check.

  • medium Social test AJAX missing capability check

    missing_capability

    wp_ajax_wpma_test likewise only verifies a nonce before invoking platform test helpers that exercise stored API credentials.

    wp-movie-announcer.php:84-101

    Recommendation

    Add the same capability gate as the settings page.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →