oceanwp

{
    "slug": "ocean-extra",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "2.5.5",
    "hit_count": 3,
    "first_hit": {
        "file": "includes/panel/classes/importers/class-settings-importer.php",
        "line": 25,
        "snippet": "L24: $raw  = file_get_contents( $file );  \u2192  L25: $data = @unserialize( $raw, [ 'allowed_classes' => false ]  );"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`/`file_get_contents`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak."
}

{
    "slug": "ocean-extra",
    "previous_version": "2.5.5",
    "current_version": "2.5.5",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/panel/classes/importers/class-settings-importer.php",
            "line": 25,
            "snippet": "L24: $raw  = file_get_contents( $file );  \u2192  L25: $data = @unserialize( $raw, [ 'allowed_classes' => false ]  );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/onboarding/class/importer/theme-settings.php",
            "line": 38,
            "snippet": "L32: $raw = file_get_contents( $file );  \u2192  L38: $data = @unserialize( $raw, [ 'allowed_classes' => false ] );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/themepanel/theme-panel.php",
            "line": 434,
            "snippet": "L433: $raw  = file_get_contents( $file );  \u2192  L434: $data = @unserialize( $raw, [ 'allowed_classes' => false ]  );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 3
}

{
    "committer": "apprimit",
    "member_since": "2016-01-12",
    "plugins_joined": 7,
    "spread_days": 182,
    "earliest_join": "2020-04-01 13:38:37",
    "latest_join": "2020-09-30 15:51:31",
    "combined_installs": 660000,
    "sample_plugins": [
        {
            "slug": "ocean-extra",
            "active_installs": 500000,
            "first_commit_at": "2020-09-30 15:51:31"
        },
        {
            "slug": "ocean-social-sharing",
            "active_installs": 70000,
            "first_commit_at": "2020-04-01 13:49:02"
        },
        {
            "slug": "ocean-custom-sidebar",
            "active_installs": 30000,
            "first_commit_at": "2020-04-01 13:38:37"
        },
        {
            "slug": "ocean-product-sharing",
            "active_installs": 20000,
            "first_commit_at": "2020-04-01 13:45:30"
        },
        {
            "slug": "ocean-stick-anything",
            "active_installs": 20000,
            "first_commit_at": "2020-04-01 13:51:03"
        },
        {
            "slug": "ocean-modal-window",
            "active_installs": 10000,
            "first_commit_at": "2020-04-01 13:41:01"
        },
        {
            "slug": "ocean-posts-slider",
            "active_installs": 10000,
            "first_commit_at": "2020-04-01 13:43:09"
        }
    ]
}

{
    "committer": "apprimit",
    "member_since": "2016-01-12",
    "plugins_joined": 5,
    "spread_days": 182,
    "earliest_join": "2020-04-01 13:38:37",
    "latest_join": "2020-09-30 15:51:31",
    "combined_installs": 640000,
    "sample_plugins": [
        {
            "slug": "ocean-extra",
            "active_installs": 500000,
            "first_commit_at": "2020-09-30 15:51:31"
        },
        {
            "slug": "ocean-social-sharing",
            "active_installs": 70000,
            "first_commit_at": "2020-04-01 13:49:02"
        },
        {
            "slug": "ocean-custom-sidebar",
            "active_installs": 30000,
            "first_commit_at": "2020-04-01 13:38:37"
        },
        {
            "slug": "ocean-product-sharing",
            "active_installs": 20000,
            "first_commit_at": "2020-04-01 13:45:30"
        },
        {
            "slug": "ocean-stick-anything",
            "active_installs": 20000,
            "first_commit_at": "2020-04-01 13:51:03"
        }
    ]
}