Elementor

{
    "slug": "elementor",
    "author_slug": "kingyes",
    "burst_start": "2026-04-13 15:21:03",
    "burst_end": "2026-04-13 15:48:38",
    "burst_commits": 6,
    "burst_window_minutes": 90,
    "tenure_days": 343,
    "distinct_messages": 6,
    "avg_message_length": 16.2,
    "top_message": "Upload v4.0.0-beta5",
    "top_message_count": 1,
    "prt_revert": null,
    "explanation": "Established author committed 6 revisions inside a 90-minute window with low-entropy commit messages. Pattern matches the June 2024 wp.org credential-stuffing wave shape; bumped to critical when followed by a wp.org Plugin Review Team revert within 7 days."
}

{
    "slug": "elementor",
    "finding_count": 11,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "core/dynamic-tags/manager.php",
            "line": 467,
            "snippet": "$tag_name = base64_decode( $tag_key_parts[0] );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "core/dynamic-tags/manager.php",
            "line": 469,
            "snippet": "$tag_settings = json_decode( urldecode( base64_decode( $tag_key_parts[1] ) ), true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "core/common/modules/connect/apps/library.php",
            "line": 119,
            "snippet": "$payload_json = base64_decode( strtr( $payload_encoded, '-_', '+/' ), true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "core/files/uploads-manager.php",
            "line": 604,
            "snippet": "$file_content = base64_decode( $file['fileData'] ); // phpcs:ignore",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/template-library/manager.php",
            "line": 924,
            "snippet": "$raw_binary = base64_decode( substr( $data['screenshot'], strlen( 'data:image/png;base64,' ) ) );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/utils.php",
            "line": 967,
            "snippet": "return base64_decode( $encoded_string, true ) ?? $fallback;",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/element-cache/module.php",
            "line": 60,
            "snippet": "$widget_data = json_decode( base64_decode( $atts['data'] ), true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/cloud-kit-library/module.php",
            "line": 80,
            "snippet": "$raw_screen_shot = base64_decode( substr( $settings['screenShotBlob'], strlen( 'data:image/png;base64,' ) ) );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "modules/ai/connect/ai.php",
            "line": 622,
            "snippet": "$img_content = base64_decode( $img_content );",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor_prefixed/twig/twig/twig/src/Environment.php",
            "line": 350,
            "snippet": "eval('?>' . $content);",
            "confidence": "medium"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 243,
            "snippet": "> \u201cI upgraded to the Pro version and just love this plugin!\u201d \u2013 \u2605\u2605\u2605\u2605\u2605 *[Andybarn56](https://wordpress.org/support/topic/love-elementor-17/)*",
            "confidence": "low"
        }
    ],
    "triage_note_2026_05_03": "elementor: base64_decode in legitimate uses (data URL parsing, dynamic-tag manager, screenshot upload) + eval in vendored Twig template engine."
}