WP Manifestindependent plugin directory
manifest / media / zype-wordpress-plugin

Zype WP Registry grade D. High-severity findings · 5 findingsWP RegistryHigh-severity findings · 5 findingsOpen the reportD

★ 4stars
844release downloads
≈40active sites
2.6.4latest · 5 years ago

Install

Download zype-wordpress-plugin-v2.6.4.zip From the 2.6.4 release on GitHub, Aug 25, 2021

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/zype/zype-wordpress-plugin/releases/download/2.6.4/zype-wordpress-plugin-v2.6.4.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Don't know what Zype is? Learn more about Zype here.

Table of Contents

Zype Wordpress Plugin

This free plugin allows you to turn your WordPress website into an eye-catching, easy to use video streaming destination integrated with the Zype platform with minimal coding and configuration. The plugin is built with PHP and the Zype API. With brief setup you can begin streaming video on your website.

Using the plugin you can sell subscriptions for premium video content, track analytics for video engagement, create playlists and insert videos using shortcodes, and even broadcast live events with just a few clicks.

The Zype cloud service provides publishing, monetization, streaming, audience management, and analytics software that is integrated into hundreds of web, mobile, and OTT apps and engaged by millions of viewers every month.

Demo Website

Full functionality of the plugin can be viewed on Zype Plugin demo website.

Key Features & Capabilities

  • Easily add videos and playlist galleries to any page or post using shortcodes.
  • Responsive design instantly works on mobile and desktop with any theme.
  • Stream your content from a wide range of sources including native video uploads, YouTube, Vimeo, Hulu, and more.
  • Your branding front and center with your own custom branded HTML5 video player.
  • Generate revenue with built-in subscription paywalls to make more money from your premium content.
  • Maximize ad revenue with preroll, midroll, and postroll ads, including support for dynamic ad pairing.
  • Broadcast high quality Live Streams anywhere on your website with just a few clicks.
  • Improve discovery and navigation for your audience by displaying playlist galleries showcasing your entire video library.

Monetization Supported

  • Subscription
  • Ads

Installation

Requirements and Prerequisites

  • A valid and current Zype account
  • Requires WordPress version: 4.6 or higher | Tested up to: 4.9.5
  • Requires PHP: 5.6

Installation via docker compose(Recommended for developers)

The repo includes a Dockerfile ready to download the dependencies and run the application(with xdebug v3 support for debugging).

NOTE: Make sure to change the database credentials in the Dockerfile before installation

To setup everything you only need to run:

  docker-compose build
  docker-compose up -d
  docker-compose exec wordpress bash -c "cd /var/www/html/wp-content/plugins/zype-plugin && composer install --no-scripts"

The composer install step downloads the project dependencies, so is actually only needed to run the first time and whenever you add a new dependency.

Installation via prebundled zip archive

Download latest release from Google Drive link in releases section in Github

  1. Log in to the administrator panel.
  2. Go to Plugins Add > New > Upload.
  3. Click Choose file (Browse) and select the downloaded zip file of the zype plugin.
  4. Click Install Now button.
  5. Click Activate Plugin button for activating the Zype.

Installation via cloning the repo (Optional for developers)

Clone or download zype-wordpress-plugin repo. If you downloaded the ZIP file, you need to unzip the file.

  1. Open up Terminal. Navigate inside downloaded repo.
cd path/to/plugin-folder # change directory to plugin folder
  1. Enter the following command to get the required libraries:

    composer install # get the latest version of required libraries with Composer
  2. After the libraries have been updated, ZIP the plugin folder.

  3. Manually add a new plugin in Wordpress and upload the ZIP file you just zipped.

Configuration

API Keys & Consumer Settings

  • Following installation you must import API and app keys from your Zype account. API and app keys will automatically validate as they are being added.
  • In order to support consumer management, you must also import your consumer OAuth keys and secret.

Enhanced Playlists

  • To set up enhanced playlists, there needs to be a root playlist set up in your Zype account. To create a root playlist, you can visit the Manage Playlist Relationships page in Zype and create a parent/child playlist structure.

Monetization

  • In order to use subscription monetization on your Wordpress website, you must have a Braintree or Stripe account and have your Braintree / Stripe settings configured in the plugin as well as in the Zype platform.

Website Integration

Shortcodes

Shortcodes can be inserted anywere on your Wordpress website and will render underlying functionality based on plugin configuration.

  • [zype_video id='Insert Video ID'] Will render a single video from your Zype account
  • [zype_playlist id='Insert Playlist ID'] Will render a playlist and all nested content from your Zype account
  • [zype_playlist id='Insert Playlist ID' zype_type=video_single] Will render all videos within a selected playlist
  • [zype_auth] Will render login/signup functionality.
  • [zype_signup] Will render signup functionality

URL rewrites

URL rewrites add new pages to your website.

Contributing to the repo

We welcome contributions to Zype Wordpress Plugin. If you have any suggestions or notice any bugs you can raise an issue. If you have any changes to the code base that you want to see added, you can fork the repository, then submit a pull request with your changes explaining what you changed, why you believe it should be added, and how one would test these changes. Thank you in advance to the community!

How to start the project

Since the project is dockerized just runnning the following will have a wordpress running with the Zypw Wordpress plugin:

docker-compose build && docker-compose up -d

if this is the first time you run the project (or if you added a new dependency) remember that you must download the dependencies (check Installation via docker compose section to see the command to download them)

Also you will probably need to change the Permalink Settings to Post name if not the routes from resources/routes.php won't work

Creating Initial user

The first time you start the app it will ask you to sign up a new user. If by some reason you removed it from the DB or you just want to do a fresh start you can remove the volumes and build the images again from scratch:

docker-compose kill && docker-compose rm
docker volume rm zype-wordpress-plugin_db zype-wordpress-plugin_wordpress
docker rmi zype-wordpress-plugin_wordpress
docker-compose build
docker-compose up -d

Debugging

VS Code

In your launch.json add the following configuration:

{
    "name": "Listen for XDebug",
    "type": "php",
    "request": "launch",
    "port": 9000,
    "log": true,
    "pathMappings": {
      "/var/www/html/wp-content/plugins/zype-plugin": "${workspaceRoot}"
    },
    "xdebugSettings": {
        "max_data": 65535,
        "show_hidden": 1,
        "max_children": 100,
        "max_depth": 5
    }
}

And just click play on

Creating new release

If you want to create a release you must remove:

  1. Once your code is in master, create a new version: git tag X.X.X and push the tag to the repo.
  2. Duplicate the project folder and rename the copy to something like zype-wordpress-plugin-vX.X.X
  3. Remove the .git folder, the docker-compose.yml and Dockerfile files.
  4. Compress the folder into a zip file.
  5. Go to the releases page and create the release Zype Wordpress Plugin vX.X.X and upload the zipped file to the release.

Support

If you need more information on how the Zype API works, you can read documentation here. If you have any other questions, feel free to contact us at support@zype.com.

Versioning

For the versions available, see the tags on this repository.

See also the list of contributors who participated in this project.

License

This project is licensed under the GPL-2.0 License - see the LICENSE file for details

Production account

There's a Zype production account https://zypeplugin.com/

Releases

Newest 25 of 36 recorded releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
2.6.4 latest
Aug 25, 2021 5 years ago
zype-wordpress-plugin-v2.6.4.zip
60
Jun 16, 2020 6 years ago
zype-wordpress-plugin-v2.6.3.zip
107
Oct 25, 2019 7 years ago
zype-wordpress-plugin-v2.6.2.zip
52
Aug 30, 2019 7 years ago
zype-wordpress-plugin-v2.6.1.zip
35
Aug 22, 2019 7 years ago
zype-wordpress-plugin-v2.6.0.zip
20
Jul 31, 2019 7 years ago
zype-wordpress-plugin-v2.5.16.zip
19
Jul 3, 2019 7 years ago
zype-wordpress-plugin-v2.5.15.zip
23
Jun 26, 2019 7 years ago
zype-wordpress-plugin-v2.5.14.zip
26
Apr 26, 2019 7 years ago
zype-wordpress-plugin-v2.5.9.zip
36
Apr 3, 2019 7 years ago
zype-wordpress-plugin-v2.5.8.zip
27
Mar 29, 2019 7 years ago
zype-wordpress-plugin-v2.5.7.zip
13
Mar 24, 2019 7 years ago
zype-wordpress-plugin.2.5.6.zip
17
Mar 24, 2019 7 years ago
zype-wordpress-plugin.2.5.5.zip
10
Feb 20, 2019 7 years ago
zype-wordpress-plugin-v2.5.4.zip
29
Feb 15, 2019 7 years ago
zype-wordpress-plugin-v2.5.3.zip
15
Feb 13, 2019 7 years ago
zype-wordpress-plugin-v2.5.2.zip
15
Jan 28, 2019 7 years ago
zype-wordpress-plugin-v2.5.1.zip
26
Jan 28, 2019 7 years ago
zype-wordpress-plugin-v2.5.zip
23
Nov 15, 2018 7 years ago
zype-wordpress-plugin-v2.0.0.zip
69
Oct 24, 2018 8 years ago
zype-wordpress-plugin-v1.1.0.zip
24
Sep 14, 2018 8 years ago
zype-plugin-1.0.0.zip
41
Aug 27, 2018 8 years ago
zype-plugin-0.9.11.zip
40
Aug 24, 2018 8 years ago
zype-plugin-0.9.10.zip
30
Aug 20, 2018 8 years ago
zype-plugin-0.9.9.zip
17
Jul 23, 2018 8 years ago
zype-wordpress-plugin-0.9.8.zip
40
All releases on GitHub →

Active-site estimate ≈40 comes from the median of recent superseded releases. Method.

D grade

Security

Zype 2.6.4 · audited by WP Registry

High-severity findings.

3 high 2 medium
Audited release
2.6.4
Findings
5
Worst severity
high
Content hash
8f5ed4bc3f1e19048f937c88…

Findings

  • high CSRF account takeover of Zype consumers via zype_update_profile (no nonce, GET-readable)

    csrf

    wp_ajax_nopriv_zype_update_profile / wp_ajax_zype_update_profile has no wp_verify_nonce. update_profile() reads name/email via Request::get() (query or body), then Zype::update_consumer($consumer_id, $access_token, $fields) using the JWT session and redirects to the profile URL. The profile form in auth/profile.php is method=POST to admin-ajax.php with only a hidden action field. A top-level GET (SameSite=Lax still sends cookies on top-level navigations) to /wp-admin/admin-ajax.php?action=zype_update_profile&email=attacker@example.com&name=x changes the victim consumer's email. The attacker then hits zype_forgot_password for that address; Profile::forgot_password_submit emails a 16-byte reset token to the attacker-controlled inbox and reset_password_submit sets a new password via admin_update_consumer. Observable: victim Zype session's email field changes; attacker receives the reset mail and can log in as that consumer (subscription, library, billing).

    resources/providers/HooksService.php:68,186-204

    Recommendation

    Require a POST-only nonce (check_ajax_referer) bound to the Zype consumer session, reject GET, and re-authenticate or send a confirmation mail before committing an email change. Do not read account-altering fields from Request::get() on a nopriv action.

  • high Any logged-in WordPress user can rewrite transactional email templates (no nonce, no capability)

    missing_capability

    plugin.php registers Action::add('admin_action_zype_email_settings', 'EmailSettings@submit'). WordPress fires admin_action_{$action} from wp-admin/admin.php for every authenticated user; Page::make(..., capability => manage_options) only gates the settings screen, not this hook. EmailSettings::submit() never calls wp_verify_nonce or current_user_can. update_email_options() writes every key of option zype_wp['emails'] (cancel_subscription, forgot_password, new_account, new_rental, new_purchase, new_pass, new_subscription) plus the *_enabled flags. A Subscriber POST to /wp-admin/admin.php with action=zype_email_settings and forgot_password=Visit https://phish.example {forgot_password_link} persists that body. Mailer::get_email_text / send() then wp_mail()s it as text/html to consumers (password-reset and receipt mail). Omitting the *_enabled fields stores false via validate_bool and silently disables reset/receipt mail. Consumer is Mailer and every Zype customer inbox.

    resources/controllers/Admin/EmailSettings.php:16-57

    Recommendation

    At the top of submit() require current_user_can('manage_options') and wp_verify_nonce(..., 'zype_email_settings'). Do not register admin_action_* handlers that are reachable by Subscribers. Keep capability checks in the handler, not only on add_menu_page.

  • high Logged-in WordPress users can replace subscription/pass plan IDs before the monetization nonce runs

    missing_nonce

    admin_action_zype_braintree maps to Admin::admin_braintree_page_save with no current_user_can. The method first takes request 'subscribe' and 'pass_plans', array_replace()s them onto options as subscribe_select and pass_plans_select, and update_option('zype_wp') — all before wp_verify_nonce(..., 'zype_braintree'). Any logged-in WP user (Subscriber included) POSTing /wp-admin/admin.php?action=zype_braintree&subscribe[]=ATTACKER_PLAN_ID overwrites which Zype plans the paywall/plansView/Monetization::paywall_view will render. After that write the nonce failure only skips Braintree/Stripe key fields. Observable: option zype_wp.subscribe_select changes; front-end [zype_auth type=plans] / paywall lists the attacker-supplied plan IDs (free/cheap plan, or empty list disabling paid signup).

    resources/controllers/Admin.php:231-246

    Recommendation

    Move both plan-array writes inside the nonce branch and require current_user_can('manage_options') before any update_option. Reject the request entirely if the nonce or capability fails.

  • medium Open redirect after Zype login via attacker-controlled redirect_url

    unsafe_input

    zype_login (nopriv) passes request redirect_url through login_submit_ajax into the JSON field 'redirect'. zype_wp.js does window.location.replace(response.redirect) on status==true with no same-origin check. login.php also echoes redirect_url into a hidden input. An attacker hosts a lookalike flow or sends the victim to admin-ajax.php?action=zype_auth_markup&type=login&redirectURL=https://evil.example; after a successful real login the browser is sent off-site while the Zype JWT is already set. login() only prefixes home_url() when the value does not already start with 'http', so an absolute https:// URL is passed through.

    resources/controllers/Consumer/Auth.php:70-112,151-155

    Recommendation

    Allowlist redirects to the current site (wp_validate_redirect / wp_safe_redirect). Drop protocol-relative and external http(s) values. Do not put an unvalidated redirect into JSON consumed by window.location.replace.

  • medium admin_action_* settings saves are nonce-only (no current_user_can) on API keys, users, and UI

    missing_capability

    admin_action_zype_api_keys, admin_action_zype_users, and admin_action_zype_customize_ui run from wp-admin/admin.php for any logged-in user. The handlers verify a nonce but never current_user_can('manage_options'). A Subscriber cannot view the manage_options screens to scrape a nonce, so this is not a stand-alone Subscriber exploit, but nonce is not authorization: any XSS in wp-admin (including finding 1 on admin-ajax.php) or any other nonce leak lets a low-priv WP user POST admin_key, oauth_client_secret, braintree_private_key, stripe_pk, and cookie_key-adjacent user URLs. Admin::admin_api_keys_page_save writes those secrets into zype_wp and then check_keys() sends the Stripe publishable key and a test PAN to api.stripe.com with sslverify false.

    resources/controllers/Admin.php:24-68,308-337

    Recommendation

    Add current_user_can('manage_options') || wp_die() as the first line of every admin_action_* callback, in addition to the nonce. Treat capability as the authorization check and the nonce as CSRF defense only.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.