iTRON

{
    "slug": "cf7-telegram",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "lib/Settings.php",
            "line": 170,
            "snippet": "$updateChecker = PucFactory::buildUpdateChecker(",
            "confidence": "high",
            "details": {
                "url": "https://github.com/hokoo/cf7-telegram",
                "url_host": "github.com",
                "slug_arg": "cf7-telegram"
            }
        }
    ],
    "resolved_sha": "587e7fbd79c478465f2d9a978a9b3ef1b2080c38"
}

{
    "slug": "cf7-telegram",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.0.8",
    "hit_count": 1,
    "first_hit": {
        "file": "lib/Settings.php",
        "line": 170,
        "snippet": "$updateChecker = PucFactory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "github_self_distro",
    "url": "https://github.com/hokoo/cf7-telegram",
    "url_host": "github.com",
    "slug_arg": "cf7-telegram"
}

{
    "slug": "cf7-telegram",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.0.8",
    "hit_count": 1,
    "first_hit": {
        "file": "lib/Settings.php",
        "line": 170,
        "snippet": "$updateChecker = PucFactory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "github_self_distro",
    "url": "https://github.com/hokoo/cf7-telegram",
    "url_host": "github.com",
    "slug_arg": "cf7-telegram"
}

{
    "slug": "cf7-telegram",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "1.0.8",
    "hit_count": 1,
    "first_hit": {
        "file": "lib/Settings.php",
        "line": 170,
        "snippet": "$updateChecker = PucFactory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "github_self_distro",
    "url": "https://github.com/hokoo/cf7-telegram",
    "url_host": "github.com",
    "slug_arg": "cf7-telegram"
}