WP Manifestindependent plugin directory
manifest / media / media-file-versioning

Media File Versioning WP RegistryMedium-severity findings · 1 findingOpen the reportB

Track and manage versions of media files in the WordPress media library.

by Robert DeVore · github.com/webdevstudios/media-file-versioning · website

★ 15stars
28release downloads
1.0.2latest · 1 year ago

Install

Download media-file-versioning.zip From the 1.0.2 release on GitHub, Feb 4, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/webdevstudios/media-file-versioning/releases/download/1.0.2/media-file-versioning.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/webdevstudios/media-file-versioning ↗

A WordPress® plugin to track and manage versions of media files in the WordPress® Media Library.

This plugin allows you to upload new versions of media files, maintain a history of previous versions, and seamlessly display these versions in the WordPress® admin interface and on the front end.

Features

  • Version Control: Automatically saves previous versions of media files when a new version is uploaded.
  • Easy Uploads: Upload new versions directly from the Media Library.
  • Admin Interface: View the current version and a list of previous versions in a user-friendly interface.
  • Shortcode Support: Display the current and previous versions on the front end using a simple shortcode.
  • Customizable Display: Automatically orders versions from most recent to oldest for better readability.

Installation

  1. Download the Plugin
    Clone or download this repository as a ZIP file.
git clone https://github.com/robertdevore/media-file-versioning.git

  1. Install the Plugin

    • Log in to your WordPress® admin dashboard.
    • Go to Plugins > Add New > Upload Plugin.
    • Upload the media-file-versioning.zip file.
    • Activate the plugin.

  2. You're Ready!

Usage

1. Managing Media Versions

  • Go to the Media Library.
  • Edit an existing media item.
  • Use the Media Versioning meta box to:
    • Upload a new version.
    • View the current version and all previous versions.

2. Shortcode

Use the [mfv] shortcode to display versions on the front end.

Shortcode Attributes:

  • id: (Required) The ID of the media item.

Example:

[mfv id="123"]

This will display the current and previous versions of the media item with ID 123 in a structured format.

Meta Box Interface

The plugin adds a Media Versioning meta box to the media edit screen:

  • Current Version: Displays the current file, including its name and upload time.
  • Previous Versions: Lists previous versions in descending order (most recent first) under a single heading.

JavaScript Integration

Admin UI

The plugin includes JavaScript to:

  • Dynamically update the version list after a new file is uploaded.
  • Reverse the order of previous versions for consistent display.

Contributing

We welcome contributions to enhance the functionality of this plugin. To contribute:

  1. Fork the repository.
  2. Create a feature branch:
git checkout -b feature/your-feature-name
  1. Commit your changes:
git commit -m "Add your feature description here"
  1. Push to your branch:
git push origin feature/your-feature-name
  1. Create a Pull Request on GitHub.

Support

If you encounter issues or have feature requests, please open an issue.

License

This plugin is licensed under the GPL-2.0+ License.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.2 latest
Feb 4, 2025 1 year ago
media-file-versioning.zip
28
1.0.1
Dec 13, 2024 1 year ago
tag only
—
1.0.0
Dec 5, 2024 1 year ago
tag only
—
B grade

Security

Media File Versioning 1.0.2 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.2
Findings
1
Worst severity
medium
Content hash
fc50284560af26344ae9be54…

Findings

  • medium Author+ can replace any Media Library file (missing edit_post on attachment_id)

    missing_capability

    media_versioning_upload_handler is the plugin's only write path. After check_ajax_referer('media_versioning_nonce') it authorizes solely with current_user_can('upload_files'), then takes $_POST['attachment_id'] (intval) as the overwrite target. There is no current_user_can('edit_post', $attachment_id), no get_post_type()==='attachment' check, and no owner comparison. An Author already has upload_files and can load their own attachment editor, where media_versioning_enqueue_scripts localizes a nonce for action media_versioning_nonce (not bound to a post ID). They POST that nonce with a victim attachment ID and a new file. wp_handle_upload stores the bytes (default MIME allowlist — not unfiltered_upload), the handler rename()s the victim's current file to a timestamped sibling, copy()s the new bytes onto get_attached_file($victim), and wp_update_post() sets that attachment's mime type and guid. WordPress core requires edit_post to alter an existing attachment; Authors lack edit_others_posts, so this is object-level authorization bypass. Subscriber/customer cannot reach it (no upload_files, no nonce). Destination paths are existing attached files (typically under uploads), so this is not arbitrary filesystem write or RCE.

    media-file-versioning.php:138-204

    Recommendation

    After the nonce and upload_files checks, require current_user_can('edit_post', $attachment_id) and verify get_post_type($attachment_id)==='attachment'. Reject missing/invalid IDs before wp_handle_upload. Optionally also require the uploaded MIME/extension to match the existing attachment so a PDF cannot be dropped onto a .jpg path.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →