WP Manifestindependent plugin directory
manifest / content / switch-post-status

Switch Post Status WP RegistryMedium-severity findings · 1 findingOpen the reportB

Switch post status from draft to publish and back.

by Gieffe edizioni srl · github.com/xxsimoxx/switch-post-status · website

★ 0stars
264release downloads
≈30active sites
1.0.3latest · 1 year ago

Install

Download switch-post-status-1.0.3.zip From the 1.0.3 release on GitHub, Dec 4, 2024

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/xxsimoxx/switch-post-status/releases/download/1.0.3/switch-post-status-1.0.3.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/xxsimoxx/switch-post-status ↗

Switch Post Status from draft to publish and back.

This plugin allows to switch post status from draft to publish and back using a link in row actions.

Configuring other actions

Use the xsxswitch_lookup filter.

Example:

add_filter ('xsxswitch_lookup', 'myprefix_custom_sps_actions');
function myprefix_custom_sps_actions($lookup) {

    // Let it handle private posts and convert them to published.
    $lookup['private'] = [
        'dst' => 'publish',
        'msg' => 'Switch to a great public post',
    ];

    // Change the text to a custom one for draft posts.
    $lookup['draft'] = [
        'dst' => 'publish',
        'msg' => 'My custom lovely message',
    ];

    return $l;
}

Privacy

To help us know the number of active installations of this plugin, we collect and store anonymized data when the plugin check in for updates. The date and unique plugin identifier are stored as plain text and the requesting URL is stored as a non-reversible hashed value. This data is stored for up to 28 days.

Releases

4 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
1.0.3 latest
Dec 4, 2024 1 year ago
switch-post-status-1.0.3.zip
53
1.0.2
Aug 31, 2022 4 years ago
switch-post-status-1.0.2.zip
166
1.0.1
Jun 6, 2022 4 years ago
switch-post-status-1.0.1.zip
30
1.0.0
Dec 6, 2021 4 years ago
switch-post-status-1.0.0.zip
15

Active-site estimate ≈30 comes from the median of recent superseded releases. Method.

B grade

Security

Switch Post Status 1.0.3 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
1.0.3
Findings
1
Worst severity
medium
Content hash
aef8d0951b66bf59cd04ee00…

Findings

  • medium Author+ broken object-level authorization on post status switch

    missing_capability

    admin_action_xsxswitch → SwitchPostStatus::switch_to is reachable by any logged-in user via wp-admin/admin.php (auth_redirect only). After a valid xsxswitch nonce, the handler casts $_REQUEST['post'] to int and gates on current_user_can('publish_posts', $post). publish_posts is a primitive capability: WordPress map_meta_cap's default branch returns array('publish_posts') and ignores the object ID, so the check is site-wide rather than per-post. Author (default: publish_posts, no edit_others_posts, no edit_pages/publish_pages) therefore passes for pages, other authors' posts, and any CPT that uses publish/draft. The row-action nonce is created as wp_create_nonce('xsxswitch') with no post ID in the action string, so the nonce from an Author's own Posts-screen link authorizes a switch of any ID. wp_update_post() does not re-check capabilities; lookup dest is draft↔publish. Subscriber/customer/contributor lack publish_posts and never receive a nonce in action_link, so they are blocked. Unauthenticated visitors never reach admin_action_*. Not RCE or stored XSS; blast is integrity of every publish/draft object on the site.

    switch-post-status.php:94-128

    Recommendation

    Require current_user_can('edit_post', $post) (object-level meta cap) and current_user_can('publish_post', $post) so the post type's publish_* primitive is used. Bind the nonce to the post (wp_create_nonce('xsxswitch-'.$post->ID) / wp_verify_nonce(..., 'xsxswitch-'.$post)). Optionally restrict to the current list-table post type instead of any ID.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →