megamenu

Member since
2014-06-19
Location
Employer
Job title
Authored
2
SVN commit access
2
Readme contributor
0
Combined install base
302k+ across 2 plugins

Alerts (0)

No open alerts.

Show 2 resolved alerts
Critical code_pattern Max Mega Menu Resolved · no_longer_matches 7d ago
Slugmegamenu
Patternunserialize_after_remote_call
Kindbuiltin
Version3.8.1
Hit count2
First hit
File
classes/scss/1.11.1/src/Cache.php
Line
136
Snippet
L135: $c = file_get_contents($fileCache); → L136: $c = unserialize($c);
Explanationa remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak.
View raw JSON
{
    "slug": "megamenu",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "3.8.1",
    "hit_count": 2,
    "first_hit": {
        "file": "classes/scss/1.11.1/src/Cache.php",
        "line": 136,
        "snippet": "L135: $c = file_get_contents($fileCache);  \u2192  L136: $c = unserialize($c);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak."
}
Critical code_scan_delta Max Mega Menu Resolved · fp_vendored_library_local_cache 7d ago
Slugmegamenu
Previous version3.8.1
Current version3.8.1
New findings
PatternKindFileLineSnippetConfidence
unserialize_after_remote_callbuiltinclasses/scss/1.11.1/src/Cache.php136L135: $c = file_get_contents($fileCache); → L136: $c = unserialize($c);high
unserialize_after_remote_callbuiltinclasses/scss/0.0.12/scss.inc.php4,352L4352: $imports = unserialize(file_get_contents($icache)); → L4352: $imports = unserialize(file_get_contents($icache));high
New finding count2
View raw JSON
{
    "slug": "megamenu",
    "previous_version": "3.8.1",
    "current_version": "3.8.1",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "classes/scss/1.11.1/src/Cache.php",
            "line": 136,
            "snippet": "L135: $c = file_get_contents($fileCache);  \u2192  L136: $c = unserialize($c);",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "classes/scss/0.0.12/scss.inc.php",
            "line": 4352,
            "snippet": "L4352: $imports = unserialize(file_get_contents($icache));  \u2192  L4352: $imports = unserialize(file_get_contents($icache));",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}

Plugins authored (2)

Plugin Version Installs Last updated Status
Max Mega Menu ·megamenu 3.9.2.1 300k+ 3d ago Active
Max Mega Menu – StoreFront Integration ·megamenu-storefront 1.0.3 2k+ 2mo ago Active

SVN commit access (2)

Plugins this account has pushed commits to, reconstructed from plugins.svn.wordpress.org. A new name showing up here on an established plugin is the strongest ownership-transfer signal.

Plugin Primary author Installs Commits First Latest Status
Max Mega Menu – StoreFront Integration megamenu 2k+ 38 9y ago 2mo ago Active
Max Mega Menu megamenu 300k+ 2 6y ago 2d ago Active