Marcin

{
    "slug": "wise-chat",
    "pattern": "getWPUsers",
    "kind": "ioc:code_pattern",
    "version": "3.4.1",
    "hit_count": 4,
    "first_hit": {
        "file": "src/DAO/User/UsersDAO.php",
        "line": 509,
        "snippet": "public function getWPUsers($parameters) {"
    },
    "explanation": null
}

{
    "slug": "wise-chat",
    "previous_version": "3.4",
    "current_version": "3.4.1",
    "new_findings": [
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/DAO/User/UsersDAO.php",
            "line": 509,
            "snippet": "public function getWPUsers($parameters) {",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Services/Channels/Listing/ChannelsSourcesService.php",
            "line": 244,
            "snippet": "$wpUsers = $this->usersDAO->getWPUsers($searchParameters);",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Services/Channels/Listing/ChannelsSourcesService.php",
            "line": 281,
            "snippet": "$wpUsers = $this->usersDAO->getWPUsers($searchParameters);",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Endpoints/UserCommandEndpoint.php",
            "line": 153,
            "snippet": "$users = $this->usersDAO->getWPUsers(array('search' => $parameters['search'], 'number' => 20));",
            "confidence": "high"
        }
    ],
    "new_finding_count": 4
}

{
    "slug": "wise-chat",
    "pattern": "direct_mysqli_connect",
    "kind": "builtin",
    "version": "3.4",
    "hit_count": 1,
    "first_hit": {
        "file": "src/Endpoints/Ultra/index.php",
        "line": 70,
        "snippet": "$dbWC = new mysqli($constants['DB_HOST'], $constants['DB_USER'], $constants['DB_PASSWORD'], $constants['DB_NAME']);"
    },
    "explanation": "plugin instantiates `new mysqli($var['host'], ...)` \u2014 a direct MySQL connection bypassing `$wpdb`. Legitimate WordPress plugins always go through `$wpdb` (which already has the connection); a raw `mysqli` connect using parsed wp-config credentials is the credential-harvesting backdoor shape."
}