Audit #33 Benign

Timeline

• 2025-07-28 — mathewt wp.org account created
• 2025-08-07 — first plugin published: image-zoom-on-hover
• 2025-08-25 — disable-right-click-content-copy-protection
• 2025-08-28 — browser-address-bar-color-changer
• 2025-09-09 — add-as-preferred-source
• 2025-11-19 — announcement-notification-bar
• 2026-05-05 07:35-07:41 UTC — synchronized release across all 5 plugins, each adding a per-plugin class-{prefix}-deactivation-feedback.php and class-{prefix}-admin-notices.php

Actor footprint

All *_RELAY_SECRET constants are set to the literal string airtable-2026-mathew. All plugins POST to the same endpoint.

Code under review

The deactivation-feedback file (e.g. includes/class-izoh-deactivation-feedback.php) registers an admin script that injects a feedback modal into the Plugins screen, hooks wp_ajax_*_submit_feedback, and on submit calls:

wp_remote_post(
    'https://startling-malasada-45aa0d.netlify.app/.netlify/functions/feedback',
    array(
        'headers' => array(
            'Content-Type'    => 'application/json',
            'X-Relay-Secret'  => IZOH_RELAY_SECRET,
        ),
        'body'    => wp_json_encode( $payload ),
        'timeout' => 15,
    )
);

The $payload array contains:

$payload = array(
    'reason'         => sanitize_text_field( $_POST['reason'] ?? '' ),
    'details'        => sanitize_textarea_field( $_POST['details'] ?? '' ),
    'admin_email'    => sanitize_email( $_POST['admin_email'] ?? '' ),  // user-fillable opt-in
    'site_name'      => get_bloginfo( 'name' ) ?: 'Unknown',
    'site_url'       => get_site_url() ?: 'Unknown',
    'wp_version'     => get_bloginfo( 'version' ) ?: 'Unknown',
    'plugin_version' => $this->version ?: 'Unknown',
);

No options, no user data, no credentials, no plugin content. Only the deactivating admin's site metadata + their typed reason + an opt-in email.

Live endpoint check

GET  https://startling-malasada-45aa0d.netlify.app/                             → 404
GET  https://startling-malasada-45aa0d.netlify.app/.netlify/functions/feedback   → 405 (Method Not Allowed)
GET  https://startling-malasada-45aa0d.netlify.app/privacy                       → 200

Endpoint is live and configured. Method 405 confirms the Netlify Function exists and only accepts the documented POST. The /privacy page exists, satisfying GDPR's basic disclosure requirement.

Hijack-indicator matrix

Clean matrix → benign.

Why this isn't a supply-chain attack

1. The endpoint receives, doesn't serve. The plugin POSTs metadata; the response is discarded (wp_remote_post return value is not used). There is no pathway for the Netlify Function to return code that gets executed. 2. The "secret" is server-to-server. IZOH_RELAY_SECRET is a PHP constant only used in the HTTP header. The browser never sees it. If the Netlify Function were to be reverse-engineered, an attacker would only gain the ability to spam Mathew's feedback inbox — they cannot affect plugin behavior on user sites. 3. Trigger is one-shot, on deactivation only. Not on activation, not on a schedule, not on every page load. A site that deactivates the plugin sends one message and stops; a site that doesn't deactivate sends nothing. 4. No version pre-fix or fingerprint check. The module doesn't check whether the running site is "interesting" before phoning home (e.g. doesn't look for ecommerce, login forms, admin sessions). It's just metadata. 5. The pattern matches established premium-plugin SDKs (Freemius, Appsero, MonsterInsights). Mathew is doing the same thing with a less polished setup.

Comparable cases

• Audit #15 (content-egg) — different shape (historical PHP-object-injection chain) but same outcome: review-tier signal, deep-dive verdict benign with cleanup notes.
• Freemius SDK pattern — known-good telemetry shape that ships in 100s of wp.org plugins. Mathew's module is structurally identical.
• WPFactory cross-selling library FP class (memory: project_wpfactory_cross_selling_fp_2026-04-27) — different actor, but same lesson: a vendor running their own opt-in admin telemetry is not by itself a security finding.

Reviewer notes

The reason this audit was opened was the actor-cluster shape, not any individual file pattern. WP Beacon's daily diff-review surfaces clusters where one author ships the same novel telemetry across multiple plugins on the same day — this is a high-value signal for early supply-chain attack detection (see the scroll-top / Benjamin / @milkitall case from audit #12 where a similar cluster was malicious). For Mathew, the cluster turned out to be a small developer adopting a feedback workflow. The audit is published as reassurance: site admins running any of the 5 plugins can see at a glance that the unfamiliar Netlify endpoint is intended, opt-in, and not a security risk.