Audit #19 Cleaned

Confirmed malicious supply-chain compromise — 30 commits in a 28-hour burst. Between 2024-06-21 23:21 UTC and 2024-06-24 03:50 UTC the legitimate blazeretail SVN account was used to push 30 commits (all with the message Upgrade) into the blaze-widget trunk, after a 4-year dormant period (last prior commit was 2020-03-26). The wp.org Plugin Review Team (frantorres) reverted the changes at r3106791 + r3106796 on 2024-06-24 and closed the plugin the same day with reason security-issue. Tags 2.5.3 and 2.5.4 visible in SVN today are PRT-authored cleanup tags (NOT malicious) — they contain a public incident notice plus an init-action handler that auto-invalidates the password of any backdoor admin account it finds (PluginAUTH, PluginGuest, Options). Payload is the canonical June 2024 backdoor: PHP admin_init handler that walks parent directories for wp-config.php, opens a direct mysqli connection, inserts an admin user PluginAUTH (email <username>@example.com, password 13 chars), POSTs the credentials as JSON to https://94.156.79.8/AddSites, and then performs cross-CMS recon (PrestaShop / Drupal / Symfony detection) reporting hits to /CMSUsers. Plus the JS-side keylogger via add_footer_script — hex-escaped eval(" ...") loading https://94.156.79.8/sc-top.js and POSTing every keystroke to https://hostpdf.co/pinche.php with cookie xcnmo-offsetgxc. Identical payload to social-warfare 4.4.7.1 (audit #14) including the distinctive pachamama() and zbvalidate_file() function names.