WP Beacon

Events

800 events (filtered). · Last rule pass 10h ago. · 4 open / 4,675 resolved overall.

State: Open Resolved All
Severity: All Critical High · 1 Medium Low · 3 Info
Rule: All author_changed author_younger_than_plugin bulk_changelog_reuse bulk_committer_takeover closed_blob_scan closed_plugin_resurrection code_pattern code_scan_delta code_scan_match committer_younger_than_plugin compromised_committer_burst contributor_added domain_younger_than_plugin forum_complaint_cluster manual_audit_seed new_committer_young_account plugin_closed prt_forum_advisory recent_prt_intervention release_after_dormancy update_hijack_shape version_compare_trap
Critical code_pattern Featured Post Creative (1k+ installs) Malicious 5mo ago
Slugfeatured-post-creative
Patternwpos_process_monthly_data
Kindioc:code_pattern
Version1.5.7.1
Hit count3
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
545
Snippet
$this->wpos_process_monthly_data( $this->analytics_slugs );
Explanation—
View raw JSON
{
    "slug": "featured-post-creative",
    "pattern": "wpos_process_monthly_data",
    "kind": "ioc:code_pattern",
    "version": "1.5.7.1",
    "hit_count": 3,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 545,
        "snippet": "$this->wpos_process_monthly_data( $this->analytics_slugs );"
    },
    "explanation": null
}
Critical code_pattern Featured Post Creative (1k+ installs) Malicious 5mo ago
Slugfeatured-post-creative
Patternanalytics.essentialplugin.com
Kindioc:domain
Version1.5.7.1
Hit count6
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "featured-post-creative",
    "pattern": "analytics.essentialplugin.com",
    "kind": "ioc:domain",
    "version": "1.5.7.1",
    "hit_count": 6,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Featured Post Creative (1k+ installs) Malicious 5mo ago
Slugfeatured-post-creative
Patternhttps://analytics.essentialplugin.com
Kindioc:url
Version1.5.7.1
Hit count5
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "featured-post-creative",
    "pattern": "https://analytics.essentialplugin.com",
    "kind": "ioc:url",
    "version": "1.5.7.1",
    "hit_count": 5,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Featured Post Creative (1k+ installs) Malicious 5mo ago
Slugfeatured-post-creative
Pattern$analytics_endpoint
Kindioc:code_pattern
Version1.5.7.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "featured-post-creative",
    "pattern": "$analytics_endpoint",
    "kind": "ioc:code_pattern",
    "version": "1.5.7.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Featured Post Creative (1k+ installs) Malicious 5mo ago
Slugfeatured-post-creative
Patternwpos_monthly_cron_hook
Kindioc:code_pattern
Version1.5.7.1
Hit count4
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
69
Snippet
add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );
Explanation—
View raw JSON
{
    "slug": "featured-post-creative",
    "pattern": "wpos_monthly_cron_hook",
    "kind": "ioc:code_pattern",
    "version": "1.5.7.1",
    "hit_count": 4,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 69,
        "snippet": "add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternanalytics.essentialplugin.com
Kindioc:domain
Version2.0.8.1
Hit count6
First hit
File
frontend-gallery-slider.php
Line
38
Snippet
<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "analytics.essentialplugin.com",
    "kind": "ioc:domain",
    "version": "2.0.8.1",
    "hit_count": 6,
    "first_hit": {
        "file": "frontend-gallery-slider.php",
        "line": 38,
        "snippet": "<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
PatternPlugin Wpos Analytics Data Starts
Kindioc:code_pattern
Version2.0.8.1
Hit count1
First hit
File
frontend-gallery-slider.php
Line
297
Snippet
/* Plugin Wpos Analytics Data Starts */
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "Plugin Wpos Analytics Data Starts",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 1,
    "first_hit": {
        "file": "frontend-gallery-slider.php",
        "line": 297,
        "snippet": "/* Plugin Wpos Analytics Data Starts */"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternunserialize_after_remote_call
Kindbuiltin
Version2.0.8.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
696
Snippet
L690: $data = @file_get_contents($url); → L696: $info = @unserialize($data);
Explanationa remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised.
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "2.0.8.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 696,
        "snippet": "L690: $data = @file_get_contents($url);  \u2192  L696: $info = @unserialize($data);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
PatternWpos_Anylc_Admin
Kindioc:code_pattern
Version2.0.8.1
Hit count6
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
15
Snippet
class Wpos_Anylc_Admin {
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "Wpos_Anylc_Admin",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 6,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 15,
        "snippet": "class Wpos_Anylc_Admin {"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternwpos_rest_api_init
Kindioc:code_pattern
Version2.0.8.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
72
Snippet
add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "wpos_rest_api_init",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 72,
        "snippet": "add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternwpos_handle_analytics_request
Kindioc:code_pattern
Version2.0.8.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
593
Snippet
'callback' => array( $this, 'wpos_handle_analytics_request' ),
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "wpos_handle_analytics_request",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 593,
        "snippet": "'callback'            => array( $this, 'wpos_handle_analytics_request' ),"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternwpos_get_plugin_version_by_file
Kindioc:code_pattern
Version2.0.8.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
657
Snippet
$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "wpos_get_plugin_version_by_file",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 657,
        "snippet": "$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternwpos_process_monthly_data
Kindioc:code_pattern
Version2.0.8.1
Hit count3
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
545
Snippet
$this->wpos_process_monthly_data( $this->analytics_slugs );
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "wpos_process_monthly_data",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 3,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 545,
        "snippet": "$this->wpos_process_monthly_data( $this->analytics_slugs );"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternhttps://analytics.essentialplugin.com
Kindioc:url
Version2.0.8.1
Hit count5
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "https://analytics.essentialplugin.com",
    "kind": "ioc:url",
    "version": "2.0.8.1",
    "hit_count": 5,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Pattern$analytics_endpoint
Kindioc:code_pattern
Version2.0.8.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "$analytics_endpoint",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Meta Slider and Carousel with Lightbox (5k+ installs) Malicious 5mo ago
Slugmeta-slider-and-carousel-with-lightbox
Patternwpos_monthly_cron_hook
Kindioc:code_pattern
Version2.0.8.1
Hit count4
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
69
Snippet
add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );
Explanation—
View raw JSON
{
    "slug": "meta-slider-and-carousel-with-lightbox",
    "pattern": "wpos_monthly_cron_hook",
    "kind": "ioc:code_pattern",
    "version": "2.0.8.1",
    "hit_count": 4,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 69,
        "snippet": "add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternunserialize_after_remote_call
Kindbuiltin
Version1.5.6.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
696
Snippet
L690: $data = @file_get_contents($url); → L696: $info = @unserialize($data);
Explanationa remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised.
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "1.5.6.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 696,
        "snippet": "L690: $data = @file_get_contents($url);  \u2192  L696: $info = @unserialize($data);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
PatternWpos_Anylc_Admin
Kindioc:code_pattern
Version1.5.6.1
Hit count6
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
15
Snippet
class Wpos_Anylc_Admin {
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "Wpos_Anylc_Admin",
    "kind": "ioc:code_pattern",
    "version": "1.5.6.1",
    "hit_count": 6,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 15,
        "snippet": "class Wpos_Anylc_Admin {"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternwpos_rest_api_init
Kindioc:code_pattern
Version1.5.6.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
72
Snippet
add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "wpos_rest_api_init",
    "kind": "ioc:code_pattern",
    "version": "1.5.6.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 72,
        "snippet": "add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternwpos_handle_analytics_request
Kindioc:code_pattern
Version1.5.6.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
593
Snippet
'callback' => array( $this, 'wpos_handle_analytics_request' ),
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "wpos_handle_analytics_request",
    "kind": "ioc:code_pattern",
    "version": "1.5.6.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 593,
        "snippet": "'callback'            => array( $this, 'wpos_handle_analytics_request' ),"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternwpos_get_plugin_version_by_file
Kindioc:code_pattern
Version1.5.6.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
657
Snippet
$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "wpos_get_plugin_version_by_file",
    "kind": "ioc:code_pattern",
    "version": "1.5.6.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 657,
        "snippet": "$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternwpos_process_monthly_data
Kindioc:code_pattern
Version1.5.6.1
Hit count3
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
545
Snippet
$this->wpos_process_monthly_data( $this->analytics_slugs );
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "wpos_process_monthly_data",
    "kind": "ioc:code_pattern",
    "version": "1.5.6.1",
    "hit_count": 3,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 545,
        "snippet": "$this->wpos_process_monthly_data( $this->analytics_slugs );"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternanalytics.essentialplugin.com
Kindioc:domain
Version1.5.6.1
Hit count6
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "analytics.essentialplugin.com",
    "kind": "ioc:domain",
    "version": "1.5.6.1",
    "hit_count": 6,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternhttps://analytics.essentialplugin.com
Kindioc:url
Version1.5.6.1
Hit count5
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "https://analytics.essentialplugin.com",
    "kind": "ioc:url",
    "version": "1.5.6.1",
    "hit_count": 5,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Pattern$analytics_endpoint
Kindioc:code_pattern
Version1.5.6.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "$analytics_endpoint",
    "kind": "ioc:code_pattern",
    "version": "1.5.6.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Portfolio and Projects (1k+ installs) Malicious 5mo ago
Slugportfolio-and-projects
Patternwpos_monthly_cron_hook
Kindioc:code_pattern
Version1.5.6.1
Hit count4
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
69
Snippet
add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );
Explanation—
View raw JSON
{
    "slug": "portfolio-and-projects",
    "pattern": "wpos_monthly_cron_hook",
    "kind": "ioc:code_pattern",
    "version": "1.5.6.1",
    "hit_count": 4,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 69,
        "snippet": "add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternanalytics.essentialplugin.com
Kindioc:domain
Version3.9.5.1
Hit count6
First hit
File
faq.php
Line
39
Snippet
<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "analytics.essentialplugin.com",
    "kind": "ioc:domain",
    "version": "3.9.5.1",
    "hit_count": 6,
    "first_hit": {
        "file": "faq.php",
        "line": 39,
        "snippet": "<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
PatternPlugin Wpos Analytics Data Starts
Kindioc:code_pattern
Version3.9.5.1
Hit count1
First hit
File
faq.php
Line
313
Snippet
/* Plugin Wpos Analytics Data Starts */
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "Plugin Wpos Analytics Data Starts",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 1,
    "first_hit": {
        "file": "faq.php",
        "line": 313,
        "snippet": "/* Plugin Wpos Analytics Data Starts */"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternunserialize_after_remote_call
Kindbuiltin
Version3.9.5.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
696
Snippet
L690: $data = @file_get_contents($url); → L696: $info = @unserialize($data);
Explanationa remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised.
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "3.9.5.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 696,
        "snippet": "L690: $data = @file_get_contents($url);  \u2192  L696: $info = @unserialize($data);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
PatternWpos_Anylc_Admin
Kindioc:code_pattern
Version3.9.5.1
Hit count6
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
15
Snippet
class Wpos_Anylc_Admin {
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "Wpos_Anylc_Admin",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 6,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 15,
        "snippet": "class Wpos_Anylc_Admin {"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternwpos_rest_api_init
Kindioc:code_pattern
Version3.9.5.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
72
Snippet
add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "wpos_rest_api_init",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 72,
        "snippet": "add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternwpos_handle_analytics_request
Kindioc:code_pattern
Version3.9.5.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
593
Snippet
'callback' => array( $this, 'wpos_handle_analytics_request' ),
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "wpos_handle_analytics_request",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 593,
        "snippet": "'callback'            => array( $this, 'wpos_handle_analytics_request' ),"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternwpos_get_plugin_version_by_file
Kindioc:code_pattern
Version3.9.5.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
657
Snippet
$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "wpos_get_plugin_version_by_file",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 657,
        "snippet": "$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternwpos_process_monthly_data
Kindioc:code_pattern
Version3.9.5.1
Hit count3
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
545
Snippet
$this->wpos_process_monthly_data( $this->analytics_slugs );
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "wpos_process_monthly_data",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 3,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 545,
        "snippet": "$this->wpos_process_monthly_data( $this->analytics_slugs );"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternhttps://analytics.essentialplugin.com
Kindioc:url
Version3.9.5.1
Hit count5
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "https://analytics.essentialplugin.com",
    "kind": "ioc:url",
    "version": "3.9.5.1",
    "hit_count": 5,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Pattern$analytics_endpoint
Kindioc:code_pattern
Version3.9.5.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "$analytics_endpoint",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern WP responsive FAQ with category plugin (4k+ installs) Malicious 5mo ago
Slugsp-faq
Patternwpos_monthly_cron_hook
Kindioc:code_pattern
Version3.9.5.1
Hit count4
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
69
Snippet
add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );
Explanation—
View raw JSON
{
    "slug": "sp-faq",
    "pattern": "wpos_monthly_cron_hook",
    "kind": "ioc:code_pattern",
    "version": "3.9.5.1",
    "hit_count": 4,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 69,
        "snippet": "add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternanalytics.essentialplugin.com
Kindioc:domain
Version1.7.6.1
Hit count6
First hit
File
wp-ticker.php
Line
36
Snippet
<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "analytics.essentialplugin.com",
    "kind": "ioc:domain",
    "version": "1.7.6.1",
    "hit_count": 6,
    "first_hit": {
        "file": "wp-ticker.php",
        "line": 36,
        "snippet": "<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
PatternPlugin Wpos Analytics Data Starts
Kindioc:code_pattern
Version1.7.6.1
Hit count1
First hit
File
wp-ticker.php
Line
282
Snippet
/* Plugin Wpos Analytics Data Starts */
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "Plugin Wpos Analytics Data Starts",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wp-ticker.php",
        "line": 282,
        "snippet": "/* Plugin Wpos Analytics Data Starts */"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternunserialize_after_remote_call
Kindbuiltin
Version1.7.6.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
696
Snippet
L690: $data = @file_get_contents($url); → L696: $info = @unserialize($data);
Explanationa remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised.
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "1.7.6.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 696,
        "snippet": "L690: $data = @file_get_contents($url);  \u2192  L696: $info = @unserialize($data);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
PatternWpos_Anylc_Admin
Kindioc:code_pattern
Version1.7.6.1
Hit count6
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
15
Snippet
class Wpos_Anylc_Admin {
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "Wpos_Anylc_Admin",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 6,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 15,
        "snippet": "class Wpos_Anylc_Admin {"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternwpos_rest_api_init
Kindioc:code_pattern
Version1.7.6.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
72
Snippet
add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "wpos_rest_api_init",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 72,
        "snippet": "add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternwpos_handle_analytics_request
Kindioc:code_pattern
Version1.7.6.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
593
Snippet
'callback' => array( $this, 'wpos_handle_analytics_request' ),
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "wpos_handle_analytics_request",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 593,
        "snippet": "'callback'            => array( $this, 'wpos_handle_analytics_request' ),"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternwpos_get_plugin_version_by_file
Kindioc:code_pattern
Version1.7.6.1
Hit count2
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
657
Snippet
$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "wpos_get_plugin_version_by_file",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 2,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 657,
        "snippet": "$version = $this->wpos_get_plugin_version_by_file($matching_product['file']);"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternwpos_process_monthly_data
Kindioc:code_pattern
Version1.7.6.1
Hit count3
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
545
Snippet
$this->wpos_process_monthly_data( $this->analytics_slugs );
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "wpos_process_monthly_data",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 3,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 545,
        "snippet": "$this->wpos_process_monthly_data( $this->analytics_slugs );"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternhttps://analytics.essentialplugin.com
Kindioc:url
Version1.7.6.1
Hit count5
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "https://analytics.essentialplugin.com",
    "kind": "ioc:url",
    "version": "1.7.6.1",
    "hit_count": 5,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Pattern$analytics_endpoint
Kindioc:code_pattern
Version1.7.6.1
Hit count1
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
17
Snippet
public $analytics_endpoint = 'https://analytics.essentialplugin.com';
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "$analytics_endpoint",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 1,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 17,
        "snippet": "public $analytics_endpoint\t= 'https://analytics.essentialplugin.com';"
    },
    "explanation": null
}
Critical code_pattern Post Ticker Ultimate (1k+ installs) Malicious 5mo ago
Slugticker-ultimate
Patternwpos_monthly_cron_hook
Kindioc:code_pattern
Version1.7.6.1
Hit count4
First hit
File
wpos-analytics/includes/class-anylc-admin.php
Line
69
Snippet
add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );
Explanation—
View raw JSON
{
    "slug": "ticker-ultimate",
    "pattern": "wpos_monthly_cron_hook",
    "kind": "ioc:code_pattern",
    "version": "1.7.6.1",
    "hit_count": 4,
    "first_hit": {
        "file": "wpos-analytics/includes/class-anylc-admin.php",
        "line": 69,
        "snippet": "add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );"
    },
    "explanation": null
}
Critical code_pattern Timeline and History slider (5k+ installs) Malicious 5mo ago
Slugtimeline-and-history-slider
Patternanalytics.essentialplugin.com
Kindioc:domain
Version2.4.5.1
Hit count6
First hit
File
timeline-and-history-slider.php
Line
37
Snippet
<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin
Explanation—
View raw JSON
{
    "slug": "timeline-and-history-slider",
    "pattern": "analytics.essentialplugin.com",
    "kind": "ioc:domain",
    "version": "2.4.5.1",
    "hit_count": 6,
    "first_hit": {
        "file": "timeline-and-history-slider.php",
        "line": 37,
        "snippet": "<p><?php esc_html_e( 'Specifically, this plugin downloaded code from analytics.essentialplugin.com and installed it in your site, while the specific case can differ, we know that they were installin"
    },
    "explanation": null
}
Critical code_pattern Timeline and History slider (5k+ installs) Malicious 5mo ago
Slugtimeline-and-history-slider
PatternPlugin Wpos Analytics Data Starts
Kindioc:code_pattern
Version2.4.5.1
Hit count1
First hit
File
timeline-and-history-slider.php
Line
299
Snippet
/* Plugin Wpos Analytics Data Starts */
Explanation—
View raw JSON
{
    "slug": "timeline-and-history-slider",
    "pattern": "Plugin Wpos Analytics Data Starts",
    "kind": "ioc:code_pattern",
    "version": "2.4.5.1",
    "hit_count": 1,
    "first_hit": {
        "file": "timeline-and-history-slider.php",
        "line": 299,
        "snippet": "/* Plugin Wpos Analytics Data Starts */"
    },
    "explanation": null
}