Property Hive

{
    "slug": "propertyhive",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "2.4.0",
    "hit_count": 1,
    "first_hit": {
        "file": "includes/class-ph-licenses.php",
        "line": 531,
        "snippet": "L525: if ( 200 !== wp_remote_retrieve_response_code( $request ) || '' === wp_remote_retrieve_b  \u2192  L531: $body = @unserialize($request['body'], ['allowed_classes' => false]);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}

{
    "slug": "propertyhive",
    "previous_version": "2.2.6",
    "current_version": "2.4.0",
    "new_findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "propertyhive.php",
            "line": 453,
            "snippet": "$decoded = base64_decode( $encoded_token, true );",
            "confidence": "medium"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/class-ph-licenses.php",
            "line": 531,
            "snippet": "L525: if ( 200 !== wp_remote_retrieve_response_code( $request ) || '' === wp_remote_retrieve_b  \u2192  L531: $body = @unserialize($request['body'], ['allowed_classes' => false]);",
            "confidence": "high"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/elementor-widgets/property-tabbed-details.php",
            "line": 847,
            "snippet": "wp_enqueue_script( 'propertyhive-facebook-embed', 'https://connect.facebook.net/en_GB/sdk.js#xfbml=1&version=v20.0', array(), null, true );",
            "confidence": "medium",
            "details": {
                "url": "https://connect.facebook.net/en_GB/sdk.js#xfbml=1&version=v20.0",
                "url_host": "connect.facebook.net"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "includes/elementor-widgets/property-embedded-virtual-tours.php",
            "line": 139,
            "snippet": "wp_enqueue_script( 'propertyhive-instagram-embed', 'https://www.instagram.com/embed.js', array(), null, true );",
            "confidence": "medium",
            "details": {
                "url": "https://www.instagram.com/embed.js",
                "url_host": "www.instagram.com"
            }
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/admin/class-ph-admin.php",
            "line": 164,
            "snippet": "$decoded_slug = base64_decode( $encoded_slug, true );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/admin/class-ph-admin.php",
            "line": 165,
            "snippet": "$decoded_plugin = base64_decode( $encoded_plugin, true );",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 6
}