WP Beacon

← All audits

Audit #18 Benign

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services · 6k+ installs · baseline 0.9.0 → head 8.2.4 · suspect committer quantumcloud · by austin · closed 2d ago

Actor: QuantumCloud (quantumcloud)
Show full summary

Suspect-shape but multiply-unreachable dead code — benign. WPBot's includes/openai/plugin-upgrader/ and includes/integration/openai/plugin-upgrader/ directories ship a self-update class (QCLD_openaiaddon_AutoUpdate) whose getRemote() method matches the high-confidence catalog IOC unserialize_after_remote_call (the exact shape behind audits #12 scroll-top, #15 content-egg). The chain is structurally unreachable today through five independent failures, the most consequential of which is that the entire plugin-upgrader/ subtree is never loaded by any other file in the plugin — orphan code shipped in 6,000 active installs since v4.3.7 (2023-02-07). No active risk; recommendation is to delete the directories.

✓
Investigated — no compromise found.

Audit retained for the record. No action required.

Plugins under the same committer's SVN access

quantumcloud holds push access to 11 plugins totalling 25k+ active installs. Each non-target plugin scans clean today but represents a one-commit hijack opportunity.

WPBot – AI ChatBot for Live Support, Lead Generation, AI Services — this audit
6k+
Comment Link Remove and Other Comment Tools — clean code, same SVN account (latent risk)
8k+
Slider Hero with Video Background, Animation — clean code, same SVN account (latent risk)
3k+
ChatBot Conversational Forms — clean code, same SVN account (latent risk)
2k+
Simple Link Directory — clean code, same SVN account (latent risk)
2k+
Tabbed Category Product Listing for Woocommerce — clean code, same SVN account (latent risk)
1k+
ChatBot for eCommerce – WoowBot — clean code, same SVN account (latent risk)
1k+
AI Infographic Maker — clean code, same SVN account (latent risk)
700
iChart – Easy Charts and Graphs — clean code, same SVN account (latent risk)
400
Logo or Image Replace by mycore.global — clean code, same SVN account (latent risk)
400
Voice Audio Widgets – Voice recorder with Forms, AI Powered STT, TTS, Transcriptions, Language Teaching — clean code, same SVN account (latent risk)
400

Plugin version history

Every release on wp.org for this plugin, color-coded by relationship to the incident. The compromise window shows where the wp.org Plugin Review Team deleted the malicious tags from SVN — those versions cannot be re-downloaded today.

  1. 0.9.0 Last clean Last clean release before incident
  2. 🛑 Compromise window 13 days · 2018-08-30 → 2018-09-12

    Malicious releases pushed during this window were deleted from SVN by the wp.org Plugin Review Team. Last malicious tag: 8.2.4.

  3. 1.0.0 PRT cleanup PRT cleanup release — incident closed
  4. 1.1.0 Clean Clean (post-cleanup)
  5. 1.1.5 Clean Clean (post-cleanup)
  6. 1.2.0 Clean Clean (post-cleanup)
  7. 1.3.0 Clean Clean (post-cleanup)
  8. 1.5.0 Clean Clean (post-cleanup)
  9. 1.6.0 Clean Clean (post-cleanup)
  10. 1.7.0 Clean Clean (post-cleanup)
  11. 1.8.0 Clean Clean (post-cleanup)
  12. 1.9.0 Clean Clean (post-cleanup)
  13. 2.0.0 Clean Clean (post-cleanup)
  14. 2.1.0 Clean Clean (post-cleanup)
  15. 2.2.0 Clean Clean (post-cleanup)
  16. 2.3.0 Clean Clean (post-cleanup)
  17. 2.4.0 Clean Clean (post-cleanup)
  18. 2.5.0 Clean Clean (post-cleanup)
  19. 2.6.0 Clean Clean (post-cleanup)
  20. 2.7.0 Clean Clean (post-cleanup)
  21. 2.8.0 Clean Clean (post-cleanup)
  22. 2.9.0 Clean Clean (post-cleanup)
  23. 2.9.1 Clean Clean (post-cleanup)
  24. 2.9.2 Clean Clean (post-cleanup)
  25. 2.9.3 Clean Clean (post-cleanup)
  26. 2.9.4 Clean Clean (post-cleanup)
  27. 2.9.5 Clean Clean (post-cleanup)
  28. 2.9.6 Clean Clean (post-cleanup)
  29. 3.0.0 Clean Clean (post-cleanup)
  30. 3.0.1 Clean Clean (post-cleanup)
  31. 3.1.0 Clean Clean (post-cleanup)
  32. 3.2.0 Clean Clean (post-cleanup)
  33. 3.2.1 Clean Clean (post-cleanup)
  34. 3.2.2 Clean Clean (post-cleanup)
  35. 3.2.3 Clean Clean (post-cleanup)
  36. 3.2.5 Clean Clean (post-cleanup)
  37. 3.2.6 Clean Clean (post-cleanup)
  38. 3.2.7 Clean Clean (post-cleanup)
  39. 3.2.8 Clean Clean (post-cleanup)
  40. 3.2.9 Clean Clean (post-cleanup)
  41. 3.3.0 Clean Clean (post-cleanup)
  42. 3.3.1 Clean Clean (post-cleanup)
  43. 3.3.2 Clean Clean (post-cleanup)
  44. 3.3.3 Clean Clean (post-cleanup)
  45. 3.3.4 Clean Clean (post-cleanup)
  46. 3.3.5 Clean Clean (post-cleanup)
  47. 3.3.6 Clean Clean (post-cleanup)
  48. 3.3.7 Clean Clean (post-cleanup)
  49. 3.3.8 Clean Clean (post-cleanup)
  50. 3.3.9 Clean Clean (post-cleanup)
  51. 3.4.0 Clean Clean (post-cleanup)
  52. 3.4.1 Clean Clean (post-cleanup)
  53. 3.4.2 Clean Clean (post-cleanup)
  54. 3.4.3 Clean Clean (post-cleanup)
  55. 3.4.4 Clean Clean (post-cleanup)
  56. 3.4.5 Clean Clean (post-cleanup)
  57. 3.4.6 Clean Clean (post-cleanup)
  58. 3.4.7 Clean Clean (post-cleanup)
  59. 3.4.8 Clean Clean (post-cleanup)
  60. 3.4.9 Clean Clean (post-cleanup)
  61. 3.5.0 Clean Clean (post-cleanup)
  62. 3.5.1 Clean Clean (post-cleanup)
  63. 3.5.2 Clean Clean (post-cleanup)
  64. 3.5.3 Clean Clean (post-cleanup)
  65. 3.5.4 Clean Clean (post-cleanup)
  66. 3.5.5 Clean Clean (post-cleanup)
  67. 3.5.6 Clean Clean (post-cleanup)
  68. 3.5.7 Clean Clean (post-cleanup)
  69. 3.5.8 Clean Clean (post-cleanup)
  70. 3.5.9 Clean Clean (post-cleanup)
  71. 3.6.0 Clean Clean (post-cleanup)
  72. 3.6.1 Clean Clean (post-cleanup)
  73. 3.6.2 Clean Clean (post-cleanup)
  74. 3.6.3 Clean Clean (post-cleanup)
  75. 3.6.4 Clean Clean (post-cleanup)
  76. 3.6.5 Clean Clean (post-cleanup)
  77. 3.6.6 Clean Clean (post-cleanup)
  78. 3.6.7 Clean Clean (post-cleanup)
  79. 3.6.8 Clean Clean (post-cleanup)
  80. 3.6.9 Clean Clean (post-cleanup)
  81. 3.7.0 Clean Clean (post-cleanup)
  82. 3.7.1 Clean Clean (post-cleanup)
  83. 3.7.2 Clean Clean (post-cleanup)
  84. 3.7.3 Clean Clean (post-cleanup)
  85. 3.7.4 Clean Clean (post-cleanup)
  86. 3.7.5 Clean Clean (post-cleanup)
  87. 3.7.6 Clean Clean (post-cleanup)
  88. 3.7.7 Clean Clean (post-cleanup)
  89. 3.7.8 Clean Clean (post-cleanup)
  90. 3.7.9 Clean Clean (post-cleanup)
  91. 3.8.0 Clean Clean (post-cleanup)
  92. 3.8.1 Clean Clean (post-cleanup)
  93. 3.8.2 Clean Clean (post-cleanup)
  94. 3.8.3 Clean Clean (post-cleanup)
  95. 3.8.5 Clean Clean (post-cleanup)
  96. 3.8.9 Clean Clean (post-cleanup)
  97. 3.9.0 Clean Clean (post-cleanup)
  98. 3.9.1 Clean Clean (post-cleanup)
  99. 3.9.2 Clean Clean (post-cleanup)
  100. 3.9.3 Clean Clean (post-cleanup)
  101. 3.9.4 Clean Clean (post-cleanup)
  102. 3.9.5 Clean Clean (post-cleanup)
  103. 3.9.6 Clean Clean (post-cleanup)
  104. 3.9.7 Clean Clean (post-cleanup)
  105. 3.9.8 Clean Clean (post-cleanup)
  106. 3.9.9 Clean Clean (post-cleanup)
  107. 4.0.1 Clean Clean (post-cleanup)
  108. 4.0.2 Clean Clean (post-cleanup)
  109. 4.0.3 Clean Clean (post-cleanup)
  110. 4.0.4 Clean Clean (post-cleanup)
  111. 4.0.5 Clean Clean (post-cleanup)
  112. 4.0.6 Clean Clean (post-cleanup)
  113. 4.0.7 Clean Clean (post-cleanup)
  114. 4.0.8 Clean Clean (post-cleanup)
  115. 4.0.9 Clean Clean (post-cleanup)
  116. 4.1.0 Clean Clean (post-cleanup)
  117. 4.1.1 Clean Clean (post-cleanup)
  118. 4.1.2 Clean Clean (post-cleanup)
  119. 4.1.3 Clean Clean (post-cleanup)
  120. 4.1.4 Clean Clean (post-cleanup)
  121. 4.1.5 Clean Clean (post-cleanup)
  122. 4.1.8 Clean Clean (post-cleanup)
  123. 4.1.9 Clean Clean (post-cleanup)
  124. 4.2.0 Clean Clean (post-cleanup)
  125. 4.2.1 Clean Clean (post-cleanup)
  126. 4.2.2 Clean Clean (post-cleanup)
  127. 4.2.3 Clean Clean (post-cleanup)
  128. 4.2.4 Clean Clean (post-cleanup)
  129. 4.2.5 Clean Clean (post-cleanup)
  130. 4.2.6 Clean Clean (post-cleanup)
  131. 4.2.7 Clean Clean (post-cleanup)
  132. 4.2.8 Clean Clean (post-cleanup)
  133. 4.2.9 Clean Clean (post-cleanup)
  134. 4.3.0 Clean Clean (post-cleanup)
  135. 4.3.1 Clean Clean (post-cleanup)
  136. 4.3.2 Clean Clean (post-cleanup)
  137. 4.3.3 Clean Clean (post-cleanup)
  138. 4.3.4 Clean Clean (post-cleanup)
  139. 4.3.7 Clean Clean (post-cleanup)
  140. 4.3.8 Clean Clean (post-cleanup)
  141. 4.3.9 Clean Clean (post-cleanup)
  142. 4.4.0 Clean Clean (post-cleanup)
  143. 4.4.1 Clean Clean (post-cleanup)
  144. 4.4.2 Clean Clean (post-cleanup)
  145. 4.4.3 Clean Clean (post-cleanup)
  146. 4.4.4 Clean Clean (post-cleanup)
  147. 4.4.5 Clean Clean (post-cleanup)
  148. 4.4.6 Clean Clean (post-cleanup)
  149. 4.4.7 Clean Clean (post-cleanup)
  150. 4.4.8 Clean Clean (post-cleanup)
  151. 4.4.9 Clean Clean (post-cleanup)
  152. 4.5.1 Clean Clean (post-cleanup)
  153. 4.5.2 Clean Clean (post-cleanup)
  154. 4.5.3 Clean Clean (post-cleanup)
  155. 4.5.4 Clean Clean (post-cleanup)
  156. 4.5.5 Clean Clean (post-cleanup)
  157. 4.5.6 Clean Clean (post-cleanup)
  158. 4.5.7 Clean Clean (post-cleanup)
  159. 4.5.8 Clean Clean (post-cleanup)
  160. 4.5.9 Clean Clean (post-cleanup)
  161. 4.6.0 Clean Clean (post-cleanup)
  162. 4.6.1 Clean Clean (post-cleanup)
  163. 4.6.2 Clean Clean (post-cleanup)
  164. 4.6.3 Clean Clean (post-cleanup)
  165. 4.6.5 Clean Clean (post-cleanup)
  166. 4.6.6 Clean Clean (post-cleanup)
  167. 4.6.7 Clean Clean (post-cleanup)
  168. 4.6.8 Clean Clean (post-cleanup)
  169. 4.6.9 Clean Clean (post-cleanup)
  170. 4.7.0 Clean Clean (post-cleanup)
  171. 4.7.1 Clean Clean (post-cleanup)
  172. 4.7.2 Clean Clean (post-cleanup)
  173. 4.7.3 Clean Clean (post-cleanup)
  174. 4.7.4 Clean Clean (post-cleanup)
  175. 4.7.5 Clean Clean (post-cleanup)
  176. 4.7.6 Clean Clean (post-cleanup)
  177. 4.7.7 Clean Clean (post-cleanup)
  178. 4.7.8 Clean Clean (post-cleanup)
  179. 4.7.9 Clean Clean (post-cleanup)
  180. 4.8.0 Clean Clean (post-cleanup)
  181. 4.8.1 Clean Clean (post-cleanup)
  182. 4.8.2 Clean Clean (post-cleanup)
  183. 4.8.3 Clean Clean (post-cleanup)
  184. 4.8.4 Clean Clean (post-cleanup)
  185. 4.8.5 Clean Clean (post-cleanup)
  186. 4.8.6 Clean Clean (post-cleanup)
  187. 4.8.7 Clean Clean (post-cleanup)
  188. 4.8.8 Clean Clean (post-cleanup)
  189. 4.8.9 Clean Clean (post-cleanup)
  190. 4.9.1 Clean Clean (post-cleanup)
  191. 4.9.2 Clean Clean (post-cleanup)
  192. 4.9.3 Clean Clean (post-cleanup)
  193. 4.9.4 Clean Clean (post-cleanup)
  194. 4.9.5 Clean Clean (post-cleanup)
  195. 4.9.6 Clean Clean (post-cleanup)
  196. 4.9.7 Clean Clean (post-cleanup)
  197. 4.9.8 Clean Clean (post-cleanup)
  198. 4.9.9 Clean Clean (post-cleanup)
  199. 5.0.1 Clean Clean (post-cleanup)
  200. 5.0.2 Clean Clean (post-cleanup)
  201. 5.0.3 Clean Clean (post-cleanup)
  202. 5.0.4 Clean Clean (post-cleanup)
  203. 5.0.5 Clean Clean (post-cleanup)
  204. 5.0.6 Clean Clean (post-cleanup)
  205. 5.0.7 Clean Clean (post-cleanup)
  206. 5.0.9 Clean Clean (post-cleanup)
  207. 5.1.0 Clean Clean (post-cleanup)
  208. 5.1.1 Clean Clean (post-cleanup)
  209. 5.1.2 Clean Clean (post-cleanup)
  210. 5.1.3 Clean Clean (post-cleanup)
  211. 5.1.4 Clean Clean (post-cleanup)
  212. 5.1.5 Clean Clean (post-cleanup)
  213. 5.1.6 Clean Clean (post-cleanup)
  214. 5.1.7 Clean Clean (post-cleanup)
  215. 5.1.8 Clean Clean (post-cleanup)
  216. 5.1.9 Clean Clean (post-cleanup)
  217. 5.2.0 Clean Clean (post-cleanup)
  218. 5.2.1 Clean Clean (post-cleanup)
  219. 5.2.2 Clean Clean (post-cleanup)
  220. 5.2.3 Clean Clean (post-cleanup)
  221. 5.2.4 Clean Clean (post-cleanup)
  222. 5.2.5 Clean Clean (post-cleanup)
  223. 5.2.6 Clean Clean (post-cleanup)
  224. 5.2.7 Clean Clean (post-cleanup)
  225. 5.2.8 Clean Clean (post-cleanup)
  226. 5.2.9 Clean Clean (post-cleanup)
  227. 5.3.0 Clean Clean (post-cleanup)
  228. 5.3.1 Clean Clean (post-cleanup)
  229. 5.3.2 Clean Clean (post-cleanup)
  230. 5.3.3 Clean Clean (post-cleanup)
  231. 5.3.4 Clean Clean (post-cleanup)
  232. 5.3.6 Clean Clean (post-cleanup)
  233. 5.3.7 Clean Clean (post-cleanup)
  234. 5.3.8 Clean Clean (post-cleanup)
  235. 5.3.9 Clean Clean (post-cleanup)
  236. 5.4.1 Clean Clean (post-cleanup)
  237. 5.4.2 Clean Clean (post-cleanup)
  238. 5.4.3 Clean Clean (post-cleanup)
  239. 5.4.4 Clean Clean (post-cleanup)
  240. 5.4.5 Clean Clean (post-cleanup)
  241. 5.4.6 Clean Clean (post-cleanup)
  242. 5.4.7 Clean Clean (post-cleanup)
  243. 5.4.8 Clean Clean (post-cleanup)
  244. 5.4.9 Clean Clean (post-cleanup)
  245. 5.5.0 Clean Clean (post-cleanup)
  246. 5.5.1 Clean Clean (post-cleanup)
  247. 5.5.2 Clean Clean (post-cleanup)
  248. 5.5.3 Clean Clean (post-cleanup)
  249. 5.5.4 Clean Clean (post-cleanup)
  250. 5.5.5 Clean Clean (post-cleanup)
  251. 5.5.6 Clean Clean (post-cleanup)
  252. 5.5.7 Clean Clean (post-cleanup)
  253. 5.5.8 Clean Clean (post-cleanup)
  254. 5.5.9 Clean Clean (post-cleanup)
  255. 5.6.0 Clean Clean (post-cleanup)
  256. 5.6.1 Clean Clean (post-cleanup)
  257. 5.6.2 Clean Clean (post-cleanup)
  258. 5.6.3 Clean Clean (post-cleanup)
  259. 5.6.4 Clean Clean (post-cleanup)
  260. 5.6.6 Clean Clean (post-cleanup)
  261. 5.6.7 Clean Clean (post-cleanup)
  262. 5.6.9 Clean Clean (post-cleanup)
  263. 5.7.0 Clean Clean (post-cleanup)
  264. 5.7.1 Clean Clean (post-cleanup)
  265. 5.7.2 Clean Clean (post-cleanup)
  266. 5.7.4 Clean Clean (post-cleanup)
  267. 5.7.3 Clean Clean (post-cleanup)
  268. 5.7.5 Clean Clean (post-cleanup)
  269. 5.7.6 Clean Clean (post-cleanup)
  270. 5.7.7 Clean Clean (post-cleanup)
  271. 5.7.8 Clean Clean (post-cleanup)
  272. 5.7.9 Clean Clean (post-cleanup)
  273. 5.8.0 Clean Clean (post-cleanup)
  274. 5.8.1 Clean Clean (post-cleanup)
  275. 5.8.3 Clean Clean (post-cleanup)
  276. 5.8.4 Clean Clean (post-cleanup)
  277. 5.8.5 Clean Clean (post-cleanup)
  278. 5.8.6 Clean Clean (post-cleanup)
  279. 5.8.7 Clean Clean (post-cleanup)
  280. 5.8.8 Clean Clean (post-cleanup)
  281. 5.8.9 Clean Clean (post-cleanup)
  282. 5.9.0 Clean Clean (post-cleanup)
  283. 5.9.1 Clean Clean (post-cleanup)
  284. 5.9.2 Clean Clean (post-cleanup)
  285. 5.9.3 Clean Clean (post-cleanup)
  286. 5.9.4 Clean Clean (post-cleanup)
  287. 5.9.5 Clean Clean (post-cleanup)
  288. 5.9.6 Clean Clean (post-cleanup)
  289. 5.9.7 Clean Clean (post-cleanup)
  290. 5.9.8 Clean Clean (post-cleanup)
  291. 5.9.9 Clean Clean (post-cleanup)
  292. 6.0.0 Clean Clean (post-cleanup)
  293. 6.0.1 Clean Clean (post-cleanup)
  294. 6.0.2 Clean Clean (post-cleanup)
  295. 6.0.3 Clean Clean (post-cleanup)
  296. 6.0.4 Clean Clean (post-cleanup)
  297. 6.0.5 Clean Clean (post-cleanup)
  298. 6.0.6 Clean Clean (post-cleanup)
  299. 6.0.7 Clean Clean (post-cleanup)
  300. 6.0.8 Clean Clean (post-cleanup)
  301. 6.0.9 Clean Clean (post-cleanup)
  302. 6.1.1 Clean Clean (post-cleanup)
  303. 6.1.2 Clean Clean (post-cleanup)
  304. 6.1.3 Clean Clean (post-cleanup)
  305. 6.1.4 Clean Clean (post-cleanup)
  306. 6.1.5 Clean Clean (post-cleanup)
  307. 6.1.6 Clean Clean (post-cleanup)
  308. 6.1.7 Clean Clean (post-cleanup)
  309. 6.1.8 Clean Clean (post-cleanup)
  310. 6.1.9 Clean Clean (post-cleanup)
  311. 6.2.1 Clean Clean (post-cleanup)
  312. 6.2.2 Clean Clean (post-cleanup)
  313. 6.2.4 Clean Clean (post-cleanup)
  314. 6.2.5 Clean Clean (post-cleanup)
  315. 6.2.6 Clean Clean (post-cleanup)
  316. 6.2.7 Clean Clean (post-cleanup)
  317. 6.2.8 Clean Clean (post-cleanup)
  318. 6.3.0 Clean Clean (post-cleanup)
  319. 6.3.1 Clean Clean (post-cleanup)
  320. 6.3.2 Clean Clean (post-cleanup)
  321. 6.3.3 Clean Clean (post-cleanup)
  322. 6.3.4 Clean Clean (post-cleanup)
  323. 6.3.5 Clean Clean (post-cleanup)
  324. 6.3.6 Clean Clean (post-cleanup)
  325. 6.3.7 Clean Clean (post-cleanup)
  326. 6.3.8 Clean Clean (post-cleanup)
  327. 6.3.9 Clean Clean (post-cleanup)
  328. 6.4.1 Clean Clean (post-cleanup)
  329. 6.4.2 Clean Clean (post-cleanup)
  330. 6.4.3 Clean Clean (post-cleanup)
  331. 6.4.4 Clean Clean (post-cleanup)
  332. 6.4.5 Clean Clean (post-cleanup)
  333. 6.4.6 Clean Clean (post-cleanup)
  334. 6.4.7 Clean Clean (post-cleanup)
  335. 6.4.8 Clean Clean (post-cleanup)
  336. 6.4.9 Clean Clean (post-cleanup)
  337. 6.5.0 Clean Clean (post-cleanup)
  338. 6.5.1 Clean Clean (post-cleanup)
  339. 6.5.2 Clean Clean (post-cleanup)
  340. 6.5.3 Clean Clean (post-cleanup)
  341. 6.5.4 Clean Clean (post-cleanup)
  342. 6.5.5 Clean Clean (post-cleanup)
  343. 6.5.6 Clean Clean (post-cleanup)
  344. 6.5.7 Clean Clean (post-cleanup)
  345. 6.5.8 Clean Clean (post-cleanup)
  346. 6.5.9 Clean Clean (post-cleanup)
  347. 6.6.0 Clean Clean (post-cleanup)
  348. 6.6.1 Clean Clean (post-cleanup)
  349. 6.6.2 Clean Clean (post-cleanup)
  350. 6.6.3 Clean Clean (post-cleanup)
  351. 6.6.4 Clean Clean (post-cleanup)
  352. 6.6.5 Clean Clean (post-cleanup)
  353. 6.6.6 Clean Clean (post-cleanup)
  354. 6.6.7 Clean Clean (post-cleanup)
  355. 6.6.8 Clean Clean (post-cleanup)
  356. 6.6.9 Clean Clean (post-cleanup)
  357. 6.7.0 Clean Clean (post-cleanup)
  358. 6.7.1 Clean Clean (post-cleanup)
  359. 6.7.2 Clean Clean (post-cleanup)
  360. 6.7.3 Clean Clean (post-cleanup)
  361. 6.7.4 Clean Clean (post-cleanup)
  362. 6.7.5 Clean Clean (post-cleanup)
  363. 6.7.6 Clean Clean (post-cleanup)
  364. 6.7.7 Clean Clean (post-cleanup)
  365. 6.7.8 Clean Clean (post-cleanup)
  366. 6.7.9 Clean Clean (post-cleanup)
  367. 6.8.0 Clean Clean (post-cleanup)
  368. 6.8.1 Clean Clean (post-cleanup)
  369. 6.8.2 Clean Clean (post-cleanup)
  370. 6.8.3 Clean Clean (post-cleanup)
  371. 6.8.4 Clean Clean (post-cleanup)
  372. 6.8.5 Clean Clean (post-cleanup)
  373. 6.8.6 Clean Clean (post-cleanup)
  374. 6.8.7 Clean Clean (post-cleanup)
  375. 6.8.8 Clean Clean (post-cleanup)
  376. 6.8.9 Clean Clean (post-cleanup)
  377. 6.9.0 Clean Clean (post-cleanup)
  378. 6.9.1 Clean Clean (post-cleanup)
  379. 6.9.2 Clean Clean (post-cleanup)
  380. 6.9.3 Clean Clean (post-cleanup)
  381. 6.9.4 Clean Clean (post-cleanup)
  382. 6.9.5 Clean Clean (post-cleanup)
  383. 6.9.6 Clean Clean (post-cleanup)
  384. 6.9.7 Clean Clean (post-cleanup)
  385. 6.9.8 Clean Clean (post-cleanup)
  386. 6.9.9 Clean Clean (post-cleanup)
  387. 7.0.0 Clean Clean (post-cleanup)
  388. 7.1.0 Clean Clean (post-cleanup)
  389. 7.1.1 Clean Clean (post-cleanup)
  390. 7.1.2 Clean Clean (post-cleanup)
  391. 7.1.3 Clean Clean (post-cleanup)
  392. 7.1.4 Clean Clean (post-cleanup)
  393. 7.1.5 Clean Clean (post-cleanup)
  394. 7.1.6 Clean Clean (post-cleanup)
  395. 7.1.7 Clean Clean (post-cleanup)
  396. 7.1.8 Clean Clean (post-cleanup)
  397. 7.1.9 Clean Clean (post-cleanup)
  398. 7.2.0 Clean Clean (post-cleanup)
  399. 7.2.1 Clean Clean (post-cleanup)
  400. 7.2.2 Clean Clean (post-cleanup)
  401. 7.2.3 Clean Clean (post-cleanup)
  402. 7.2.4 Clean Clean (post-cleanup)
  403. 7.2.5 Clean Clean (post-cleanup)
  404. 7.2.6 Clean Clean (post-cleanup)
  405. 7.2.7 Clean Clean (post-cleanup)
  406. 7.2.8 Clean Clean (post-cleanup)
  407. 7.2.9 Clean Clean (post-cleanup)
  408. 7.3.0 Clean Clean (post-cleanup)
  409. 7.3.1 Clean Clean (post-cleanup)
  410. 7.3.2 Clean Clean (post-cleanup)
  411. 7.3.3 Clean Clean (post-cleanup)
  412. 7.3.4 Clean Clean (post-cleanup)
  413. 7.3.5 Clean Clean (post-cleanup)
  414. 7.3.6 Clean Clean (post-cleanup)
  415. 7.3.7 Clean Clean (post-cleanup)
  416. 7.3.8 Clean Clean (post-cleanup)
  417. 7.3.9 Clean Clean (post-cleanup)
  418. 7.4.0 Clean Clean (post-cleanup)
  419. 7.4.1 Clean Clean (post-cleanup)
  420. 7.4.2 Clean Clean (post-cleanup)
  421. 7.4.3 Clean Clean (post-cleanup)
  422. 7.4.4 Clean Clean (post-cleanup)
  423. 7.4.5 Clean Clean (post-cleanup)
  424. 7.4.6 Clean Clean (post-cleanup)
  425. 7.4.7 Clean Clean (post-cleanup)
  426. 7.4.8 Clean Clean (post-cleanup)
  427. 7.4.9 Clean Clean (post-cleanup)
  428. 7.5.0 Clean Clean (post-cleanup)
  429. 7.5.1 Clean Clean (post-cleanup)
  430. 7.5.2 Clean Clean (post-cleanup)
  431. 7.5.3 Clean Clean (post-cleanup)
  432. 7.5.4 Clean Clean (post-cleanup)
  433. 7.5.5 Clean Clean (post-cleanup)
  434. 7.5.6 Clean Clean (post-cleanup)
  435. 7.5.7 Clean Clean (post-cleanup)
  436. 7.5.8 Clean Clean (post-cleanup)
  437. 7.5.9 Clean Clean (post-cleanup)
  438. 7.6.0 Clean Clean (post-cleanup)
  439. 7.6.1 Clean Clean (post-cleanup)
  440. 7.6.2 Clean Clean (post-cleanup)
  441. 7.6.3 Clean Clean (post-cleanup)
  442. 7.6.4 Clean Clean (post-cleanup)
  443. 7.6.5 Clean Clean (post-cleanup)
  444. 7.6.6 Clean Clean (post-cleanup)
  445. 7.6.7 Clean Clean (post-cleanup)
  446. 7.6.8 Clean Clean (post-cleanup)
  447. 7.6.9 Clean Clean (post-cleanup)
  448. 7.7.0 Clean Clean (post-cleanup)
  449. 7.7.1 Clean Clean (post-cleanup)
  450. 7.7.2 Clean Clean (post-cleanup)
  451. 7.7.3 Clean Clean (post-cleanup)
  452. 7.7.4 Clean Clean (post-cleanup)
  453. 7.7.5 Clean Clean (post-cleanup)
  454. 7.7.6 Clean Clean (post-cleanup)
  455. 7.7.7 Clean Clean (post-cleanup)
  456. 7.7.8 Clean Clean (post-cleanup)
  457. 7.7.9 Clean Clean (post-cleanup)
  458. 7.8.0 Clean Clean (post-cleanup)
  459. 7.8.1 Clean Clean (post-cleanup)
  460. 7.8.2 Clean Clean (post-cleanup)
  461. 7.8.3 Clean Clean (post-cleanup)
  462. 7.8.4 Clean Clean (post-cleanup)
  463. 7.8.5 Clean Clean (post-cleanup)
  464. 7.8.6 Clean Clean (post-cleanup)
  465. 7.8.7 Clean Clean (post-cleanup)
  466. 7.8.8 Clean Clean (post-cleanup)
  467. 7.8.9 Clean Clean (post-cleanup)
  468. 7.9.0 Clean Clean (post-cleanup)
  469. 7.9.1 Clean Clean (post-cleanup)
  470. 7.9.2 Clean Clean (post-cleanup)
  471. 7.9.3 Clean Clean (post-cleanup)
  472. 7.9.4 Clean Clean (post-cleanup)
  473. 7.9.5 Clean Clean (post-cleanup)
  474. 7.9.6 Clean Clean (post-cleanup)
  475. 7.9.7 Clean Clean (post-cleanup)
  476. 7.9.8 Clean Clean (post-cleanup)
  477. 7.9.9 Clean Clean (post-cleanup)
  478. 8.0.0 Clean Clean (post-cleanup)
  479. 8.1.0 Clean Clean (post-cleanup)
  480. 8.2.0 Clean Clean (post-cleanup)
  481. 8.2.1 Clean Clean (post-cleanup)
  482. 8.2.2 Clean Clean (post-cleanup)
  483. 8.2.3 Clean Clean (post-cleanup)
  484. 8.2.4 Current Current release

Suspect-shape but multiply-unreachable dead code — benign. WPBot's includes/openai/plugin-upgrader/ and includes/integration/openai/plugin-upgrader/ directories ship a self-update class (QCLD_openaiaddon_AutoUpdate) whose getRemote() method matches the high-confidence catalog IOC unserialize_after_remote_call (the exact shape behind audits #12 scroll-top, #15 content-egg). The chain is structurally unreachable today through five independent failures, the most consequential of which is that the entire plugin-upgrader/ subtree is never loaded by any other file in the plugin — orphan code shipped in 6,000 active installs since v4.3.7 (2023-02-07). No active risk; recommendation is to delete the directories.

Plugin

| | | |---|---| | Slug | chatbot | | Name | WPBot — AI ChatBot for Live Support, Lead Generation, AI Services | | Author | quantumcloud (QuantumCloud, Executive Director, member since 2011-12-11) | | Active installs | 6,000 | | Total downloads | 1,231,616 | | Added | 2018-08-30 | | Last update | 2026-04-29 (v8.2.4) — yesterday | | Closed? | No |

Why WP Beacon flagged this

code_pattern event #1758 fired with pattern=unserialize_after_remote_call, confidence=high, hit_count=2. The two hits are duplicate copies of the same file at:

  • includes/openai/plugin-upgrader/classes/plugin-upgrader.php:190
  • includes/integration/openai/plugin-upgrader/classes/plugin-upgrader.php:190
// classes/plugin-upgrader.php:169-195
public function getRemote($action = '')
{
    $params = array(
        'body' => array(
            'action'       => $action,
            'plugin-slug'  => $this->slug,
            'license_user' => $this->license_user,
            'license_key'  => $this->license_key,
        ),
    );
    
    $request = wp_remote_post($this->update_path, $params );

    if ( !is_wp_error( $request ) || wp_remote_retrieve_response_code( $request ) === 200 ) {
        return @unserialize( $request['body'] );                         // ← IOC sink
    }
    
    return false;
}

Looks like a textbook self-update channel: license credentials POSTed to a remote endpoint, response @unserialize'd as PHP, no signature, no integrity check. Same shape that made scroll-top a real RCE distribution channel (audit #12, malicious) and that lurked dormant in content-egg for 7 years (audit #15, benign-historical).

The five layers of unreachability

Layer 1 — orphan directory (decisive)

The whole plugin-upgrader/ subtree is loaded by nothing. Searched the full trunk:

$ grep -rn "plugin-upgrader" trunk/ --include='*.php' \
    | grep -v "^trunk/includes/.*/plugin-upgrader/"
# (no output)

The plugin's main file qcld-wpwbot.php lists every require_once at the top — none touch plugin-upgrader/. Neither does includes/integration/openai/qcld-bot-openai.php (the OpenAI integration's own loader). The directory is shipped to wp.org but never PHP-loaded at runtime.

Layer 2 — dispatcher itself stubbed out

The "outer" file plugin-upgrader/plugin-upgrader.php (which would load the class file if anything required it) consists entirely of commented-out lines:

<?php
// require_once(plugin_dir_path(__FILE__).'/config.php');
// require_once(plugin_dir_path(__FILE__).'/classes/plugin-upgrader.php');
// require_once(plugin_dir_path(__FILE__).'/admin/license-settings-page.php');
// require_once(plugin_dir_path(__FILE__).'/admin/admin-notices.php');
// require_once(plugin_dir_path(__FILE__).'/utils.php');
// new qcld_openaiaddon_License_Settings_page();

So even if a future contributor requires the dispatcher, all the inner loads are commented out. They'd have to uncomment those too.

Layer 3 — typo in update_path (breaks wp_remote_post)

If both layers 1 and 2 were bypassed, utils.php:9 would still pass the wrong constant:

$plugin_remote_path = openaiaddon_LICENSING_PLUGIN_NAME;       // ← typo
//                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
//                   defined as 'chatbot-openai-addon' (slug, not URL)
//
//   intended:       openaiaddon_LICENSING_REMOTE_PATH
//                   = 'https://www.ultrawebmedia.com/li/plugins/chatbot-openai-addon/update.php'

wp_remote_post("chatbot-openai-addon", $params) returns WP_Error (invalid URL). The if-condition !is_wp_error($request) || response_code === 200 becomes false || false (no response, no code) → falls through to return false. @unserialize never runs.

This typo has been there since the file was first added at v4.3.7 (2023-02-07, r2861400 "Added OpenAI support") and was carried forward into the duplicate path created at v6.6.5 (2025-05-15) when QuantumCloud refactored to add OpenRouter support. 3 years of unreachability via this typo alone.

Layer 4 — endpoint dead (since 2019)

Even with layers 1-3 fixed, the intended endpoint https://www.ultrawebmedia.com/li/plugins/chatbot-openai-addon/update.php is dead:

$ curl -s -I "https://www.ultrawebmedia.com/"
HTTP/2 200 
last-modified: Tue, 28 May 2019 11:28:03 GMT
content-length: 780
content-type: text/html

The site has served a "Website Under Maintenance" 503 page since 2019. Worse, the server isn't executing PHP — the maintenance file leaks raw <?php source as text. Domain still resolves and is presumably owned by QuantumCloud, but the licensing infrastructure has been decommissioned for ~7 years.

If the endpoint were restored and serving HTML rather than PHP-serialized payloads, @unserialize($html) returns false → harmless.

Layer 5 — admin-set conditional gate

Final layer: even if 1-4 were all bypassed and the endpoint served PHP-serialized data, instantiation only happens when:

if( $buy_from == 'quantumcloud' ){                              // utils.php:13
    $upgrader_instance = new qcld_openaiaddon_AutoUpdate(...);
}

$buy_from is get_option('qcld_openaiaddon_buy_from_where') — set via the plugin's license-settings admin form. Default is empty (no instantiation). So the user has to actively configure the plugin to a license source that's been broken since 2019.

Origin and provenance

| Date | Tag | Event | |---|---|---| | 2023-02-07 | v4.3.7 | r2861400 "Added OpenAI support" — entire includes/openai/plugin-upgrader/ directory created in one commit. The typo (_PLUGIN_NAME instead of _REMOTE_PATH), the commented-out dispatcher, and the @unserialize chain all introduced together. Code looks copy-pasted from a generic 2010s-era WordPress self-update template. | | 2025-05-15 | v6.6.5 | r3293987 "Added OpenRouter Support" — includes/integration/openai/plugin-upgrader/ directory added as a duplicate of includes/openai/plugin-upgrader/. Refactor leftover; old path still exists. Both copies have the same dead-code shape. | | 2025-10-14 | v7.x | r3378160 "Code optimization and security fixes" — touched the upgrader files but didn't fix the typo or wire up the loader. | | 2026-04-16 | v8.2.0 | r3508060 "Improved security" — added if (!defined('ABSPATH')) exit; guard to utils.php and a few other files. Standard wp.org-review hygiene; does not affect the chain. | | 2026-04-29 | v8.2.4 | Latest release — chain unchanged, still orphan. |

Author identity

quantumcloud is a real WP-ecosystem company:

  • Display name: QuantumCloud, member since 2011-12-11
  • Job title: Executive Director, employer: QuantumCloud (verified via wp_wpbeacon_authors)
  • 15 plugins on wp.org, biggest are comment-link-remove (8k installs) and chatbot (6k)
  • Sole committer across full chatbot history (482 SVN commits, 2018-08 → 2026-04)

I sampled 5 of the other QuantumCloud plugins (comment-link-remove, woowbot-woocommerce-chatbot, slider-hero, conversational-forms, simple-link-directory) — none have a similar @unserialize-after-remote-post chain. The pattern is unique to chatbot's abandoned licensing scaffold.

Domains the plugin actually contacts

scan-deltas harvested 19 domains for chatbot:

  • AI providers (legit, expected): openai.com, openrouter.ai, x.ai, gemini.ai, googleapis.com, dialogflow.com, google.com, facebook.net
  • Messaging integrations (legit): viber.com, whatsapp.com, youtube.com
  • QuantumCloud's own brands: quantumcloud.com, wpbot.pro, woowbot.pro, ultrawebmedia.com (maintenance), turbopowers.com, testversions.com
  • Other: cxthemes.com, dna88.com — both QuantumCloud demo/dev domains

No callback to dynamic-DNS, no hardcoded IPs, no Russian/Chinese VPS. Author identity matches all reachable domains.

Verdict

Benign — dead code shipped. Same verdict class as audits #15 (content-egg) and #17 (YARPP): suspect-static-pattern, multiply unreachable. Difference: YARPP's chain has one gate (the typo'd is_array check) — close enough to weaponizable that I called it "fragile." Chatbot has five layers, and the outer one (orphan directory) is the kind of mistake that's normally caught by basic test coverage. To weaponize you'd need 3+ separate code edits AND a server-side change to a domain that's been dark for 7 years. Practical risk: zero today, low even on hostile-takeover scenarios.

Recommendations

To author (QuantumCloud), in priority order:

1. Delete both includes/openai/plugin-upgrader/ and includes/integration/openai/plugin-upgrader/ directories. They've been unreachable orphan code for 3 years. Their only effect is making static analyzers (Patchstack, Wordfence, WP Beacon) flag the plugin. If licensing is needed, use Freemius (already integrated by other QuantumCloud plugins) or EDD-SL with signed payloads. 2. Stop shipping .idea/ IntelliJ project metadata in tags. v8.2.0 included tags/8.2.0/.idea/workspace.xml etc. — leaks dev environment details (no credentials, but unnecessary). Add .idea/ to .svnignore for tag releases. 3. If keeping the licensing module for any reason, fix utils.php:9 (_PLUGIN_NAME → _REMOTE_PATH) only after wiring up an integrity-checked replacement for @unserialize. The current code is a textbook PHP Object Injection sink that has been disarmed only by accident.

To WP Beacon detector:

This is now the third audit (#15, #17, #18) in the unserialize_after_remote_call "suspect-but-unreachable" disposition class. The triage cost is real (each one requires git-level forensics to confirm unreachability). Two enhancements worth considering:

  • cleanup_status = fragile as an audit verdict-class, with fragile_gates JSON column listing the sentinel-strings (e.g. is_array($remote['body']) for YARPP, commented-out require_once for chatbot, throw new Exception for content-egg). A fragile-recheck scan phase would re-confirm those sentinels every pass and fire audit_gate_dropped if any disappears.
  • A "load-reachability" filter on the unserialize_after_remote_call rule — if the file containing the match is require_once'd from nowhere in the codebase, downgrade to info rather than critical. Would have auto-cleared chatbot's 5,000+ similar future reports without needing a full audit.

Cleanup status

cleanup_status = clean — chain has never been reachable in any production scenario. No remediation needed for site owners running chatbot today. Author should land recommendation #1 to remove the static IOC from future detector runs, but the surface is already secure.

Everything in this audit is reproducible from the links cited above: SVN log, RDAP records, GitHub repositories, wp.org forum threads, and any live endpoints. Full WP Beacon scan logs and any associated zip artifacts are available on request from the investigator.