Author: MalteseSolutions

Alerts (1)

Low code_pattern FireEMS Stats 20h ago

Slug	fireems-stats
Pattern	`puc_update_hijack`
Kind	`builtin`
Version	`4.0.1`
Hit count	1
First hit	File `fireems-stats.php` Line 67 Snippet $myUpdateChecker = Puc_v4_Factory::buildUpdateChecker('http://upgrade.maltesesolutions.com/fireems-stats/fireems.json', __FILE__, 'fireems-stats');
Explanation	plugin calls `::buildUpdateChecker()` — the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.
Shape	`vendor_updater`
Url	http://upgrade.maltesesolutions.com/fireems-stats/fireems.json
Url host	`upgrade.maltesesolutions.com`
Slug arg	`fireems-stats`

View raw JSON

{
    "slug": "fireems-stats",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "4.0.1",
    "hit_count": 1,
    "first_hit": {
        "file": "fireems-stats.php",
        "line": 67,
        "snippet": "$myUpdateChecker = Puc_v4_Factory::buildUpdateChecker('http://upgrade.maltesesolutions.com/fireems-stats/fireems.json', __FILE__, 'fireems-stats');"
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "vendor_updater",
    "url": "http://upgrade.maltesesolutions.com/fireems-stats/fireems.json",
    "url_host": "upgrade.maltesesolutions.com",
    "slug_arg": "fireems-stats"
}

Show 1 resolved alert

Critical code_pattern FireEMS Stats Resolved · no_longer_matches 13d ago

Slug	fireems-stats
Pattern	`puc_update_hijack`
Kind	`builtin`
Version	`4.0.1`
Hit count	1
First hit	File `fireems-stats.php` Line 67 Snippet $myUpdateChecker = Puc_v4_Factory::buildUpdateChecker('http://upgrade.maltesesolutions.com/fireems-stats/fireems.json', __FILE__, 'fireems-stats');
Explanation	plugin calls `::buildUpdateChecker()` — the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.
Shape	`hijack`
Url	http://upgrade.maltesesolutions.com/fireems-stats/fireems.json
Url host	`upgrade.maltesesolutions.com`
Slug arg	`fireems-stats`

View raw JSON

{
    "slug": "fireems-stats",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "4.0.1",
    "hit_count": 1,
    "first_hit": {
        "file": "fireems-stats.php",
        "line": 67,
        "snippet": "$myUpdateChecker = Puc_v4_Factory::buildUpdateChecker('http://upgrade.maltesesolutions.com/fireems-stats/fireems.json', __FILE__, 'fireems-stats');"
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "hijack",
    "url": "http://upgrade.maltesesolutions.com/fireems-stats/fireems.json",
    "url_host": "upgrade.maltesesolutions.com",
    "slug_arg": "fireems-stats"
}

Plugins authored (2)

Plugin	Version	Installs	Last updated	Status
Reset Database ·`reset-database`	1.1.3	40	7y ago	Active
FireEMS Stats ·`fireems-stats`	4.0.1	10	6y ago	Active

SVN commit access (1)

Plugins this account has pushed commits to, reconstructed from plugins.svn.wordpress.org. A new name showing up here on an established plugin is the strongest ownership-transfer signal.

Plugin	Primary author	Installs	Commits	First	Latest	Status
Reset Database	maltesesolutions	40	20	10y ago	7y ago	Active

Mike

Alerts (1)

Plugins authored (2)

SVN commit access (1)