Skip to main content

Rentiva v5.1.0 / Pro v5.1.0 — Security hardening, and no third-party calls at all

· 2 min read
MaxHandMade
MaxHandMade
Maintainer

A hardening pass ahead of the WordPress.org listing. The free plugin's features and behaviour are unchanged — what changed is how carefully it handles input, output and permissions, and what it no longer ships.

Security​

  • Contact-form attachments are now resolved through WordPress's own upload APIs with containment checks, closing a file-path handling issue.
  • Creating a customer WordPress account requires the create_users capability, and the REST routes that do it are gated on the matching user-management capability rather than a looser one.
  • Additional output escaping, settings array-key sanitization, and proper registration of public query variables across the admin and frontend.

The plugin now makes no external requests whatsoever​

Testimonial and account avatars used to come from Gravatar. They are now rendered locally from the person's initials. That was the last third-party call in the plugin: nothing it loads — including its webfont — comes from anywhere but your own site. No analytics, no geolocation, no remote fonts or scripts.

This matters beyond privacy hygiene. A plugin that quietly contacts an external service is a plugin whose behaviour depends on that service being up, reachable and trustworthy. Now there is nothing to depend on.

Removed: the demo-data seeder​

The bundled demo-data tool and its sample images are gone from the plugin. They existed to make a fresh install look populated; they also meant every site carried a set of images and a data-writing tool it would use once, if ever.

Documented: how to rebuild from source​

The readme gained a Source code section describing the React build and pointing at the public repository. The four React admin screens ship as compiled bundles, and their un-minified sources ship alongside them — so nothing in the plugin is opaque.

Pro v5.1.0​

The paid add-on now attaches to the free plugin only through neutral WordPress hooks, and ships its own assets rather than relying on the free plugin to carry them. The free plugin contains no licensing or paid-feature scaffolding at all — not disabled, not gated: absent.

Upgrading​

No action required. Your settings and data are unaffected.