Northern Beaches Websites

{
    "slug": "ideapush",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "8.77",
    "hit_count": 1,
    "first_hit": {
        "file": "ideapush.php",
        "line": 1220,
        "snippet": "$plugin_update_checker_ideapush = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "hijack",
    "url": "https://northernbeacheswebsites.com.au/?update_action=get_metadata&update_slug=ideapush",
    "url_host": "northernbeacheswebsites.com.au",
    "slug_arg": "ideapush"
}

{
    "slug": "wp-custom-admin-interface",
    "finding_count": 5,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "wp-custom-admin-interface.php",
            "line": 1080,
            "snippet": "@eval($stripPhpTags);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "wp-custom-admin-interface.php",
            "line": 787,
            "snippet": "$extractedSettings = unserialize(base64_decode($settings), array('allowed_classes' => false));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "wp-custom-admin-interface.php",
            "line": 1558,
            "snippet": "$topLevelMenuDecoded = json_decode(base64_decode($topLevelMenu),true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "wp-custom-admin-interface.php",
            "line": 1564,
            "snippet": "$subLevelMenuDecoded = json_decode(base64_decode($subLevelMenu),true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "wp-custom-admin-interface.php",
            "line": 2041,
            "snippet": "$toolbarMenuDecoded = json_decode(base64_decode($toolbarMenu));",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "a02bf0a77834ba6b4cd7eb3c22ddbab046783fb9"
}

{
    "slug": "ideapush",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "8.77",
    "hit_count": 1,
    "first_hit": {
        "file": "ideapush.php",
        "line": 1220,
        "snippet": "$plugin_update_checker_ideapush = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "vendor_updater",
    "url": "https://northernbeacheswebsites.com.au/?update_action=get_metadata&update_slug=ideapush",
    "url_host": "northernbeacheswebsites.com.au",
    "slug_arg": "ideapush"
}

{
    "slug": "wp-gotowebinar",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "15.11",
    "hit_count": 1,
    "first_hit": {
        "file": "wp-gotowebinar.php",
        "line": 1179,
        "snippet": "$plugin_update_checker_wp_gotowebinar = Puc_v4_Factory::buildUpdateChecker("
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "vendor_updater",
    "url": "https://northernbeacheswebsites.com.au/?update_action=get_metadata&update_slug=wp-gotowebinar",
    "url_host": "northernbeacheswebsites.com.au",
    "slug_arg": "wp-gotowebinar"
}