Author: rsjoomla – WP Beacon

Alerts (0)

No open alerts.

Show 1 resolved alert

Critical code_pattern RSFirewall! Resolved · benign_architectural_concern 2d ago

Slug	rsfirewall
Pattern	`unserialize_after_remote_call`
Kind	`builtin`
Version	`1.1.46`
Hit count	1
First hit	File `libraries/autoupdate.php` Line 180 Snippet L176: $request = wp_remote_post($this->update_path, $params ); → L180: return @unserialize( $request['body'] );
Explanation	a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised.

View raw JSON

{
    "slug": "rsfirewall",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "1.1.46",
    "hit_count": 1,
    "first_hit": {
        "file": "libraries/autoupdate.php",
        "line": 180,
        "snippet": "L176: $request = wp_remote_post($this->update_path, $params );  \u2192  L180: return @unserialize( $request['body'] );"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}

Plugins authored (1)

Plugin	Version	Installs	Last updated	Status
RSFirewall! ·`rsfirewall`	1.1.46	4k+	1mo ago	Active

SVN commit access (1)

Plugins this account has pushed commits to, reconstructed from plugins.svn.wordpress.org. A new name showing up here on an established plugin is the strongest ownership-transfer signal.

Plugin	Primary author	Installs	Commits	First	Latest	Status
RSFirewall!	rsjoomla	4k+	55	6y ago	1mo ago	Active

RSJoomla!

Alerts (0)

Plugins authored (1)

SVN commit access (1)