View raw JSON
{
"slug": "vk-blocks",
"pattern": "puc_update_hijack",
"kind": "builtin",
"version": "1.118.2",
"hit_count": 1,
"first_hit": {
"file": "vk-blocks.php",
"line": 202,
"snippet": "$vk_blocks_update_checker = YahnisElsts\\PluginUpdateChecker\\v5\\PucFactory::buildUpdateChecker("
},
"explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
"shape": "premium_sibling",
"url": "https://license.vektor-inc.co.jp/check/?action=get_metadata&slug=vk-blocks-pro",
"url_host": "license.vektor-inc.co.jp",
"slug_arg": "vk-blocks-pro"
}