WP Manifestindependent plugin directory
manifest / ai / pattern-pal

Pattern Pal WP RegistryMedium-severity findings · 1 findingOpen the reportB

Generate custom WordPress® block patterns using OpenAI AI. Brought to you by Plugin Pal.

by Plugin Pal · github.com/webdevstudios/pattern-pal · website

★ 11stars
49release downloads
≈10active sites
1.1.0latest · 1 year ago

Install

Download pattern-pal.zip From the 1.1.0 release on GitHub, Feb 12, 2025

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/webdevstudios/pattern-pal/releases/download/1.1.0/pattern-pal.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.
Readme github.com/webdevstudios/pattern-pal ↗

Brought to you by: Plugin Pal

Pattern Pal is a free AI-powered WordPress® plugin that allows you to generate custom block patterns in the Gutenberg editor using OpenAI's GPT-4o model. Simply describe your desired block pattern, and the plugin will generate valid WordPress® block markup for you.

Features:

  • AI-Powered Block Patterns -- Generate complex block layouts with a simple text description.
  • Theme Awareness -- Uses your theme's color palette for consistency.
  • Gutenberg Integration -- Works directly in the WordPress® Block Editor.
  • Custom API Key -- Use your own OpenAI API key for full control.
  • Instant Pattern Insertion -- AI-generated block patterns appear immediately in the editor.

Installation

Manual Installation:

  1. Download the latest release from GitHub.

  2. Upload the pattern-pal folder to /wp-content/plugins/.

  3. Activate the plugin through Plugins > Installed Plugins in WordPress®.

Usage

Generating Block Patterns

  1. In the Block Editor, add the Pattern Pal - Pattern Generator block.

  2. Enter a description of your desired pattern (e.g., "A hero section with a background image and a call-to-action button").

  3. Click Generate, and Pattern Pal will insert the AI-generated pattern into the editor.

Configuring API Settings

  • Go to Settings > Pattern Pal in the WordPress admin panel.
  • Enter your OpenAI API Key.
  • Save changes.

Frequently Asked Questions

1. Do I need an OpenAI API key?

Yes, you need an OpenAI API key to generate block patterns. Get a key from OpenAI.

2. Will Pattern Pal work with my theme?

Yes! The plugin automatically detects and applies your theme's color palette.

3. Can I customize generated patterns?

Absolutely! You can edit the generated pattern like any other block in Gutenberg.

4. Does Pattern Pal store my API key securely?

Yes, your API key is stored securely in the WordPress® options table.

Releases

2 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.1.0 latest
Feb 12, 2025 1 year ago
pattern-pal.zip
42
1.0.0
Feb 9, 2025 1 year ago
pattern-pal.zip
7

Active-site estimate ≈10 comes from the median of recent superseded releases. Method.

B grade

Security

Pattern Pal 1.1.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.1.0
Findings
1
Worst severity
medium
Content hash
87bc3fb9228d548388574574…

Findings

  • medium OpenAI API key sent with TLS certificate verification disabled

    insecure_config

    pattern_pal_generate_pattern() loads the site-wide OpenAI secret from option pattern_pal_api_key and posts it as Authorization: Bearer … to a hardcoded https://api.openai.com/v1/chat/completions URL, but the wp_remote_post() args set sslverify => false. WordPress's HTTP API therefore accepts any certificate for that host. The call is reachable by any user who can pass current_user_can('edit_posts') and the pattern_pal_nonce (Contributor+ in the block editor; Subscriber is denied). A network attacker on the path between the WordPress host and OpenAI can intercept the Bearer token and create completions billed to the site owner. Request URL and method are not attacker-controlled (not SSRF). Model output is still passed through wp_kses_post before JSON, so this is credential theft / billing abuse, not RCE or stored XSS.

    includes/api-handler.php:90-101

    Recommendation

    Remove the sslverify argument (leave WordPress defaults, which verify the peer certificate). Keep the hardcoded api.openai.com URL. Do not log or return the key. Optionally restrict generate to a capability tighter than edit_posts if Contributors should not spend the shared key.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →