WP Manifestindependent plugin directory
manifest / ecommerce / vrcore

Vacation Rentals Core WP RegistryMedium-severity findings · 1 findingOpen the reportB

VRCore: Work in Progress!

by mrahmadawais, WPTie · github.com/wptie/vrcore · website

★ 3stars
1.0.0latest · 9 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/wptie/vrcore/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/wptie/vrcore ↗

VRCore v0.0.8

[Work in progress!] Add vacation rentals to your WordPress site with membership, agents, partners, search, and frontend booking features.

Architecture

  • vr-core.php: Main plugin file that includes vrc.php
  • vrc.php: Main initializer for everything

Design Pattern

Let's assume we are building a functionality called feature

  • Folder: feature
  • File: feature-init.php includes everything classes and actions/filters
  • File: class-feature.php main class that interacts with other small classes
  • File: cpt-feature.php class for the Custom Post Type
  • File: ct-feature-taxonomy.php class for the custom taxonomy
  • File: feature-custom a custom class for a sub-feature
  • File: class-feature-meta-boxes class for related meta boxes

Releases

3 releases.

Tag
Published
1.0.0 latest
Feb 20, 2017 9 years ago
0.0.9
Sep 13, 2016 10 years ago
0.0.8
May 19, 2016 10 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Vacation Rentals Core 1.0.0 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.0
Findings
1
Worst severity
medium
Content hash
c283fb70cc2a64b34bdc2cc8…

Findings

  • medium Meta Box delete-file AJAX missing capability check

    missing_capability

    wp_ajax_rwmb_delete_file verifies nonce rwmb-delete-file_{field_id} then delete_post_meta and optionally wp_delete_attachment without current_user_can('edit_post') / delete_post. Any authenticated user who obtains the field nonce can remove attachments.

    assets/meta-boxes/meta-box/inc/fields/file.php:66-80

    Recommendation

    Require current_user_can('edit_post', $post_id) (and delete_post for force_delete) after nonce verification.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →