Events

{
    "slug": "cf7-telegram",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "lib/Settings.php",
            "line": 170,
            "snippet": "$updateChecker = PucFactory::buildUpdateChecker(",
            "confidence": "high",
            "details": {
                "url": "https://github.com/hokoo/cf7-telegram",
                "url_host": "github.com",
                "slug_arg": "cf7-telegram"
            }
        }
    ],
    "resolved_sha": "587e7fbd79c478465f2d9a978a9b3ef1b2080c38"
}

{
    "slug": "bold-timeline-lite",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "bold-builder-light/bold-builder-light.php",
            "line": 79,
            "snippet": "$updateChecker = Puc_v4_Factory::buildUpdateChecker(",
            "confidence": "high",
            "details": {
                "url": null,
                "url_host": null,
                "slug_arg": null
            }
        }
    ],
    "resolved_sha": "9bd1d2430f3c9cebc0b8531acd725caaaba3db67"
}

{
    "slug": "nexter-extension",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 779,
            "snippet": "L769: $response = wp_remote_post($theme_api_url, $args);  \u2192  L779: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 871,
            "snippet": "L870: $body = wp_remote_retrieve_body( $response );  \u2192  L871: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "include/panel-settings/extensions/nexter-ext-adobe-font.php",
            "line": 190,
            "snippet": "wp_enqueue_style( 'nexter-adobe-typekit','https://use.typekit.net/'.esc_attr($font_val['project_id']).'.css', [], NEXTER_EXT_VER );",
            "confidence": "medium",
            "details": {
                "url": "https://use.typekit.net/",
                "url_host": "use.typekit.net"
            }
        }
    ],
    "resolved_sha": "20dc3c2b4ca1db5173676e40fea3b86880ee9bb2"
}

{
    "slug": "osm",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "osm_map/osm-oljs2.php",
            "line": 269,
            "snippet": "$Layer .= 'var layerOSMHillshadeMap   = new OpenLayers.Layer.TMS(\"OSMHillshadeMap\", \" http://129.206.74.245:8004/tms_hs.ashx?x={x}&y={y}&z={z} \",{ numZoomLevels: 18, type: \"png\", getURL: getTi",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "osm_map/osm-oljs2_v4.php",
            "line": 268,
            "snippet": "$Layer .= 'var layerOSMHillshadeMap   = new OpenLayers.Layer.TMS(\"OSMHillshadeMap\", \" http://129.206.74.245:8004/tms_hs.ashx?x={x}&y={y}&z={z} \",{ numZoomLevels: 18, type: \"png\", getURL: getTi",
            "confidence": "high"
        }
    ],
    "resolved_sha": "94d2a163e16650eed4f8b3e1521ee3e3a2c96e9c"
}

{
    "slug": "content-egg",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "application/libs/RestClient.php",
            "line": 240,
            "snippet": "L224: $error_mess .= ' Server replay: ' . \\wp_remote_retrieve_body($response);  \u2192  L240: $res = @unserialize($response);",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "application/libs/admitad/AdmitadProducts.php",
            "line": 22,
            "snippet": "const API_URI_BASE = 'http://185.58.206.88/wp';",
            "confidence": "high"
        },
        {
            "pattern": "http://185.58.206.88/wp",
            "kind": "ioc:url",
            "file": "application/libs/admitad/AdmitadProducts.php",
            "line": 22,
            "snippet": "const API_URI_BASE = 'http://185.58.206.88/wp';",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "080032542a37c0a08bd49e58d34ba62518d465c6"
}

{
    "slug": "ultimate-social-media-plus",
    "finding_count": 16,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "helpers/linkedin-api/linkedin-api.php",
            "line": 123,
            "snippet": "eval($eval);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "helpers/sfsi_plus_OAuth.php",
            "line": 212,
            "snippet": "$decoded_sig = base64_decode($signature);",
            "confidence": "medium"
        },
        {
            "pattern": "shopify-js-bucket.s3.ap-south-1.amazonaws.com",
            "kind": "ioc:domain",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1712,
            "snippet": "$installed = $upgrader->install('https://shopify-js-bucket.s3.ap-south-1.amazonaws.com/sfsi_worker_premium_installer-0.0.1.zip');",
            "confidence": "high"
        },
        {
            "pattern": "https://shopify-js-bucket.s3.ap-south-1.amazonaws.com/sfsi_worker_premium_installer-0.0.1.zip",
            "kind": "ioc:url",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1712,
            "snippet": "$installed = $upgrader->install('https://shopify-js-bucket.s3.ap-south-1.amazonaws.com/sfsi_worker_premium_installer-0.0.1.zip');",
            "confidence": "high"
        },
        {
            "pattern": "wp_ajax_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1691,
            "snippet": "add_action('wp_ajax_worker_plugin','sfsi_plus_worker_plugin');",
            "confidence": "high"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1691,
            "snippet": "add_action('wp_ajax_worker_plugin','sfsi_plus_worker_plugin');",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1693,
            "snippet": "function sfsi_plus_worker_plugin(){",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1709,
            "snippet": "if (sfsi_plus_worker_plugin_installed($plugin_slug)) {",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1729,
            "snippet": "if (sfsi_plus_worker_plugin_installed($plugin_slug)) {",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1751,
            "snippet": "if(!function_exists(\"sfsi_plus_worker_plugin_installed\")){",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1752,
            "snippet": "function sfsi_plus_worker_plugin_installed($slug)",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1768,
            "snippet": "if(!function_exists(\"sfsi_plus_worker_plugin_installed\")){",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_plus_worker_plugin",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1769,
            "snippet": "function sfsi_plus_worker_plugin_installed($slug)",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_worker_premium_installer",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1705,
            "snippet": "$plugin_slug= \"sfsi_worker_premium_installer/sfsi_worker_premium_installer.php\";",
            "confidence": "medium"
        },
        {
            "pattern": "sfsi_worker_premium_installer",
            "kind": "ioc:code_pattern",
            "file": "libs/controllers/sfsi_buttons_controller.php",
            "line": 1712,
            "snippet": "$installed = $upgrader->install('https://shopify-js-bucket.s3.ap-south-1.amazonaws.com/sfsi_worker_premium_installer-0.0.1.zip');",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "f1e614500005bab34cabbb580c25d1f1717976f4"
}

{
    "slug": "woo-orders-tracking",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "includes/class-vi-woo-orders-tracking-trackingmore.php",
            "line": 331,
            "snippet": "return vi_wot_json_decode( '[{\"courier_name\":\"DHL Express\",\"courier_code\":\"dhl\",\"courier_type\":\"express\",\"courier_phone\":null,\"country_code\":\"DE\",\"courier_url\":\"http://www.dhl.com/en/express/tracki",
            "confidence": "high"
        }
    ],
    "resolved_sha": "6949683cda5f7533f3b2e3487823b6a1b488dd61"
}

{
    "slug": "video-conferencing-with-zoom-api",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "includes/admin/class-zvc-admin-ajax.php",
            "line": 345,
            "snippet": "$users      = vczapi_getWpUsers_basedon_UserRoles($args);",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "includes/admin/class-zvc-admin-ajax.php",
            "line": 442,
            "snippet": "$users         = vczapi_getWpUsers_basedon_UserRoles([",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "includes/helpers.php",
            "line": 833,
            "snippet": "function vczapi_getWpUsers_basedon_UserRoles( $defaults = [] ) {",
            "confidence": "high"
        }
    ],
    "resolved_sha": "4b8acd19aad08e7ae6be3b5d2614d60e6fdb7d88"
}

{
    "slug": "slider-wd",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "slider-wd.php",
            "line": 886,
            "snippet": "wp_register_script($this->prefix . '_youtube', 'https://www.youtube.com/iframe_api');",
            "confidence": "medium",
            "details": {
                "url": "https://www.youtube.com/iframe_api",
                "url_host": "www.youtube.com"
            }
        }
    ],
    "resolved_sha": "78367a7f3dd9bac9b3460f7241461452d816f8eb",
    "serial_offender_note": "Severity bumped high\u2192critical: author 10web has 6 prior security-issue closures on wp.org."
}

{
    "slug": "gravity-forms-google-analytics-event-tracking",
    "finding_count": 15,
    "findings": [
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.6.0/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.5.3/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.5.5/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.4.5/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.5.2/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.6.2/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.5.1/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.4.4/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.4.3/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.4.1/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.5.4/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.5.0/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.4.2/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.6.1/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        },
        {
            "pattern": "$analytics_endpoint",
            "kind": "ioc:code_pattern",
            "file": "tags/1.4.0/public/includes/ga-mp/src/Racecore/GATracking/GATracking.php",
            "line": 59,
            "snippet": "private $analytics_endpoint = 'http://www.google-analytics.com/collect';",
            "confidence": "high"
        }
    ],
    "resolved_sha": "ffe17072f481001259e703cd4473606f91f341d7"
}

{
    "slug": "fv-wordpress-flowplayer",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/fp-api-private.php",
            "line": 381,
            "snippet": "L371: $raw_response = wp_remote_post( $this->strPrivateAPI, $request );  \u2192  L381: $response = @unserialize( preg_replace( '~^/\\*[\\s\\S]*?\\*/\\s+~', '', $raw_respons",
            "confidence": "high"
        }
    ],
    "resolved_sha": "28641141fc4be13117ae150b04ac279035fccf01"
}

{
    "slug": "bit-integrations",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "backend/controller/UserController.php",
            "line": 14,
            "snippet": "public function getWpUsers()",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "backend/Routes/ajax.php",
            "line": 55,
            "snippet": "Route::post('user/list', [UserController::class, 'getWpUsers']);",
            "confidence": "high"
        }
    ],
    "resolved_sha": "78a05a9d6bc5b7e9a801ff1881380691e2fd16cc"
}

{
    "slug": "wp-webhooks",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "core/includes/classes/class-wp-webhooks-run.php",
            "line": 1275,
            "snippet": "0 => 'a:1:{s:13:\"administrator\";b:1;}',",
            "confidence": "high"
        }
    ],
    "resolved_sha": "07403c6f6c5142c62231297dada2baa407b88601"
}

{
    "slug": "powerpress",
    "finding_count": 5,
    "findings": [
        {
            "pattern": "PluginGuest",
            "kind": "ioc:code_pattern",
            "file": "powerpress.php",
            "line": 69,
            "snippet": "$affectedusernames = ['PluginAUTH', 'PluginGuest', 'Options'];",
            "confidence": "high"
        },
        {
            "pattern": "PRT_incidence_response_230624",
            "kind": "ioc:code_pattern",
            "file": "powerpress.php",
            "line": 105,
            "snippet": "$temphash = 'PRT_incidence_response_230624';",
            "confidence": "medium"
        },
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "powerpress.php",
            "line": 69,
            "snippet": "$affectedusernames = ['PluginAUTH', 'PluginGuest', 'Options'];",
            "confidence": "high"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "powerpress.php",
            "line": 54,
            "snippet": "<?php   if(function_exists('add_footer_script')){",
            "confidence": "medium"
        },
        {
            "pattern": "add_footer_script",
            "kind": "ioc:code_pattern",
            "file": "powerpress.php",
            "line": 55,
            "snippet": "esc_html_e( 'In addition, a function called \"add_footer_script\" may have been modified/added to the functions.php file in your theme. This will have to be manually checked. Updating to a new ve",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "8a1744f1470504ea430ba06ed613bbe28af3e601"
}

{
    "slug": "wp-database-backup",
    "finding_count": 17,
    "findings": [
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3096,
            "snippet": "preg_match( \"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3099,
            "snippet": "preg_match( \"/'DB_USER',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3102,
            "snippet": "preg_match( \"/'DB_PASSWORD',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3105,
            "snippet": "preg_match( \"/'DB_HOST',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3122,
            "snippet": "preg_match( \"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "includes/admin/lib/class-pclzip.php",
            "line": 3863,
            "snippet": "$v_file_content = @gzinflate($v_buffer);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "includes/admin/lib/class-pclzip.php",
            "line": 4086,
            "snippet": "$v_file_content = gzinflate($v_buffer);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "includes/admin/lib/class-pclzip.php",
            "line": 4196,
            "snippet": "if (($p_string = @gzinflate($v_data)) === FALSE) {",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/admin/Destination/Google/google-api-php-client/src/service/Google_Utils.php",
            "line": 37,
            "snippet": "return base64_decode($b64);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/admin/Destination/SFTP/test-sftp.php",
            "line": 40,
            "snippet": "$pkey   = isset($wpdbbkp_sftp_details['sftp_key'])?base64_decode($wpdbbkp_sftp_details['sftp_key']):'';",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/admin/Destination/SFTP/preflight.php",
            "line": 31,
            "snippet": "$pkey   = isset($wpdbbkp_sftp_details['sftp_key'])?base64_decode($wpdbbkp_sftp_details['sftp_key']):'';",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/admin/Destination/SFTP/sendaway.php",
            "line": 18,
            "snippet": "$pkey       = isset($wpdbbkp_sftp_details['sftp_key']) ? base64_decode($wpdbbkp_sftp_details['sftp_key']) : '';",
            "confidence": "medium"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 180,
            "snippet": "preg_match(\"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 193,
            "snippet": "preg_match(\"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 196,
            "snippet": "preg_match(\"/'DB_USER',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        }
    ],
    "resolved_sha": "08e42c678f268245e4b159727c193d5a4c793465"
}

{
    "slug": "zero-bs-crm",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "includes/jpcrm-templating-placeholders.php",
            "line": 1718,
            "snippet": "$owner_value = zeroBS_getWPUsersMobile($owner_info->ID);",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "includes/ZeroBSCRM.DAL3.Helpers.php",
            "line": 6918,
            "snippet": "if ($ownerID > 0) return zeroBS_getWPUsersMobile($ownerID);",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "includes/ZeroBSCRM.DAL3.Helpers.php",
            "line": 6927,
            "snippet": "function zeroBS_getWPUsersMobile($uID =-1){",
            "confidence": "high"
        }
    ],
    "resolved_sha": "fa86225828fbdbee701cfe2d2e60e3c7cce9bd31"
}

{
    "slug": "persian-woocommerce-sms",
    "finding_count": 17,
    "findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/SMSPishgaman.php",
            "line": 66,
            "snippet": "$client                   = new nusoap_client( 'http://82.99.216.45/services/?wsdl', true );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/RazPayamak.php",
            "line": 33,
            "snippet": "$client       = new SoapClient( \"http://37.228.138.118/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/HostIran.php",
            "line": 35,
            "snippet": "$client       = new SoapClient( \"http://37.228.138.118/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/IranSMSCOM.php",
            "line": 32,
            "snippet": "$client       = new SoapClient( \"http://87.107.52.205/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/GamaPayamak.php",
            "line": 34,
            "snippet": "$client       = new SoapClient( \"http://37.228.138.118/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/ParsianSMS.php",
            "line": 38,
            "snippet": "$remote = wp_remote_get( 'http://185.4.31.182/class/sms/webservice/send_url.php?' . $content );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/NiazPardazCOM.php",
            "line": 34,
            "snippet": "$client       = new SoapClient( \"http://37.228.138.118/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/ParandSMS.php",
            "line": 32,
            "snippet": "$client = new SoapClient( \"http://87.107.121.52/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/LoginPanel.php",
            "line": 33,
            "snippet": "$client       = new SoapClient( \"http://87.107.121.52/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/IdehPayam.php",
            "line": 34,
            "snippet": "$soap = new SoapClient( \"http://185.112.33.61/webservice/send.php?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/PanelChi.php",
            "line": 11,
            "snippet": "public string $api_url = 'http://185.141.171.123/wbs/send.php?wsdl';",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/SMSBefrest.php",
            "line": 34,
            "snippet": "$client = new SoapClient( \"http://87.107.121.52/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/ChaparPanel.php",
            "line": 33,
            "snippet": "$client       = new SoapClient( \"http://87.107.121.52/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/SMSMeli.php",
            "line": 35,
            "snippet": "$client       = new SoapClient( \"http://37.228.138.118/post/send.asmx?wsdl\" );",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "src/Gateways/MehrPanel.php",
            "line": 33,
            "snippet": "$client = new SoapClient( \"http://87.107.121.52/post/send.asmx?wsdl\" );",
            "confidence": "high"
        }
    ],
    "resolved_sha": "c51402e7a9e1e5770cf9e2aea9c501f05205ccd6"
}

{
    "slug": "bookly-responsive-appointment-booking-tool",
    "finding_count": 5,
    "findings": [
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "backend/components/dialogs/customer/edit/Dialog.php",
            "line": 41,
            "snippet": ": $wpdb->get_results( self::getWPUsersQuery() . ' ORDER BY u.display_name', ARRAY_A );",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "backend/components/dialogs/customer/edit/Dialog.php",
            "line": 84,
            "snippet": "public static function getWPUsersQuery()",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "backend/components/dialogs/customer/edit/Ajax.php",
            "line": 115,
            "snippet": "? $wpdb->get_row( Dialog::getWPUsersQuery() . ( is_multisite() ? ' AND ' : ' WHERE ' ) . ' ID = ' . (int) $customer['wp_user_id'] )",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "backend/components/dialogs/customer/edit/Ajax.php",
            "line": 128,
            "snippet": "public static function getWPUsersList()",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "backend/components/dialogs/customer/edit/Ajax.php",
            "line": 135,
            "snippet": "$query = Dialog::getWPUsersQuery();",
            "confidence": "high"
        }
    ],
    "resolved_sha": "71e8b6c5c6dcc3a09c53aa6e577dcecd7028ab65"
}

{
    "slug": "learnpress",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "inc/admin/lp-admin-functions.php",
            "line": 807,
            "snippet": "'%' . $wpdb->esc_like( 's:13:\"administrator\"' ) . '%',",
            "confidence": "high"
        }
    ],
    "resolved_sha": "4dcb8e34952801acb277f5b44858418ee7283f19"
}

{
    "slug": "ameliabooking",
    "finding_count": 22,
    "findings": [
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Infrastructure/Licence/Lite/Licence.php",
            "line": 154,
            "snippet": "Commands\\User\\GetWPUsersCommand::class                                        => new Commands\\User\\GetWPUsersCommandHandler($c),",
            "confidence": "high"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaBookingShortcodeService.php",
            "line": 50,
            "snippet": "wp_enqueue_script('amelia_stripe_script', 'https://js.stripe.com/v3/');",
            "confidence": "medium",
            "details": {
                "url": "https://js.stripe.com/v3/",
                "url_host": "js.stripe.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaBookingShortcodeService.php",
            "line": 55,
            "snippet": "wp_enqueue_script('amelia_square_js', 'https://sandbox.web.squarecdn.com/v1/square.js');",
            "confidence": "medium",
            "details": {
                "url": "https://sandbox.web.squarecdn.com/v1/square.js",
                "url_host": "sandbox.web.squarecdn.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaBookingShortcodeService.php",
            "line": 57,
            "snippet": "wp_enqueue_script('amelia_square_js', 'https://web.squarecdn.com/v1/square.js');",
            "confidence": "medium",
            "details": {
                "url": "https://web.squarecdn.com/v1/square.js",
                "url_host": "web.squarecdn.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaBookingShortcodeService.php",
            "line": 69,
            "snippet": "wp_enqueue_script('amelia_razorpay_script', 'https://checkout.razorpay.com/v1/checkout.js');",
            "confidence": "medium",
            "details": {
                "url": "https://checkout.razorpay.com/v1/checkout.js",
                "url_host": "checkout.razorpay.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaShortcodeService.php",
            "line": 48,
            "snippet": "wp_enqueue_script('amelia_razorpay_script', 'https://checkout.razorpay.com/v1/checkout.js');",
            "confidence": "medium",
            "details": {
                "url": "https://checkout.razorpay.com/v1/checkout.js",
                "url_host": "checkout.razorpay.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaShortcodeService.php",
            "line": 73,
            "snippet": "wp_enqueue_script('amelia_stripe_js', 'https://js.stripe.com/v3/');",
            "confidence": "medium",
            "details": {
                "url": "https://js.stripe.com/v3/",
                "url_host": "js.stripe.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaShortcodeService.php",
            "line": 78,
            "snippet": "wp_enqueue_script('amelia_square_js', 'https://sandbox.web.squarecdn.com/v1/square.js');",
            "confidence": "medium",
            "details": {
                "url": "https://sandbox.web.squarecdn.com/v1/square.js",
                "url_host": "sandbox.web.squarecdn.com"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "src/Infrastructure/WP/ShortcodeService/AmeliaShortcodeService.php",
            "line": 80,
            "snippet": "wp_enqueue_script('amelia_square_js', 'https://web.squarecdn.com/v1/square.js');",
            "confidence": "medium",
            "details": {
                "url": "https://web.squarecdn.com/v1/square.js",
                "url_host": "web.squarecdn.com"
            }
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Infrastructure/Routes/User/User.php",
            "line": 19,
            "snippet": "use AmeliaBooking\\Application\\Controller\\User\\GetWPUsersController;",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Infrastructure/Routes/User/User.php",
            "line": 39,
            "snippet": "$app->get('/users/wp-users', GetWPUsersController::class);",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Application/Commands/User/GetWPUsersCommand.php",
            "line": 8,
            "snippet": "* Class GetWPUsersCommand",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Application/Commands/User/GetWPUsersCommand.php",
            "line": 12,
            "snippet": "class GetWPUsersCommand extends Command",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Application/Commands/User/GetWPUsersCommandHandler.php",
            "line": 14,
            "snippet": "* Class GetWPUsersCommandHandler",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "src/Application/Commands/User/GetWPUsersCommandHandler.php",
            "line": 18,
            "snippet": "class GetWPUsersCommandHandler extends CommandHandler",
            "confidence": "high"
        }
    ],
    "resolved_sha": "894b99867e8a92a02ae40e7d0f900249d59b2e38"
}

{
    "slug": "vk-blocks",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "vk-blocks.php",
            "line": 204,
            "snippet": "$vk_blocks_update_checker = YahnisElsts\\PluginUpdateChecker\\v5\\PucFactory::buildUpdateChecker(",
            "confidence": "high",
            "details": {
                "url": "https://license.vektor-inc.co.jp/check/?action=get_metadata&slug=vk-blocks-pro",
                "url_host": "license.vektor-inc.co.jp",
                "slug_arg": "vk-blocks-pro"
            }
        }
    ],
    "resolved_sha": "8b47c00984f544dab136a3e9cb7ef280c8bf888d"
}

{
    "slug": "templates-patterns-collection",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/TI_Beaver.php",
            "line": 167,
            "snippet": "L148: $response = wp_remote_get( esc_url_raw( $url ) );  \u2192  L167: if ( @unserialize( $serialized_string ) !== true && preg_match( '/^[aOs]:/', $serialized",
            "confidence": "high"
        }
    ],
    "resolved_sha": "9d5e8bf99105ec63a2a55513062262777d7a98bb"
}

{
    "slug": "yet-another-related-posts-plugin",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "classes/YARPP_Core.php",
            "line": 2112,
            "snippet": "L2105: $remote  = wp_remote_post( \"https://yarpp.org/checkversion.php?format=php&version={$vers  \u2192  L2112: if ( $result = @unserialize( $remote['body'] ) ) {",
            "confidence": "high"
        }
    ],
    "resolved_sha": "d2ffee2bbdb2f9ef0a7928617437a9a64a329d63"
}

{
    "slug": "ninjafirewall",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "lib/help.php",
            "line": 250,
            "snippet": "<p><strong>' . __('Block HTTP requests with an IP in the <code>HTTP_HOST</code> header', 'ninjafirewall'). '</strong><br />' . sprintf( __('This option will reject any request using an IP instead of",
            "confidence": "high"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "lib/utils.php",
            "line": 1319,
            "snippet": "if ( strpos( $value, 's:13:\"administrator\"') === FALSE &&",
            "confidence": "high"
        }
    ],
    "resolved_sha": "1095ac9416dc08e5caf20e6f832baafd1a48e900"
}

{
    "slug": "cloudflare-flexible-ssl",
    "finding_count": 2,
    "findings": [
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 4,
            "snippet": "* Plugin URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        },
        {
            "pattern": "PluginAUTH",
            "kind": "ioc:code_pattern",
            "file": "plugin.php",
            "line": 9,
            "snippet": "* Author URI: https://icwp.io/cloudflaresslpluginauthor",
            "confidence": "high"
        }
    ],
    "resolved_sha": "b6d92bc1f800748579e12e926ee460c0df4670de"
}

{
    "slug": "photo-gallery",
    "finding_count": 6,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "frontend/views/view.php",
            "line": 17,
            "snippet": "wp_register_script( 'instagram-embed', 'https://www.instagram.com/embed.js' );",
            "confidence": "medium",
            "details": {
                "url": "https://www.instagram.com/embed.js",
                "url_host": "www.instagram.com"
            }
        },
        {
            "pattern": "Validate_Path(",
            "kind": "ioc:code_pattern",
            "file": "filemanager/controller.php",
            "line": 45,
            "snippet": "$dir = str_replace(array('\\\\', '..'), '', WDWLibrary::validate_path($this->model->get_from_session('dir', '')));",
            "confidence": "medium"
        },
        {
            "pattern": "Validate_Path(",
            "kind": "ioc:code_pattern",
            "file": "filemanager/view.php",
            "line": 77,
            "snippet": "var dir = \"<?php echo(isset($_REQUEST['dir']) ? str_replace(array('\\\\', '..'), '', WDWLibrary::validate_path(WDWLibrary::get('dir', '', 'sanitize_text_field', 'REQUEST'))) : ''); ?>\";",
            "confidence": "medium"
        },
        {
            "pattern": "Validate_Path(",
            "kind": "ioc:code_pattern",
            "file": "filemanager/view.php",
            "line": 78,
            "snippet": "var dirUrl = \"<?php echo $this->controller->get_uploads_url() . (isset($_REQUEST['dir']) ? str_replace(array('\\\\', '..'), '',  WDWLibrary::validate_path(WDWLibrary::get('dir', '', 'sanitize_text",
            "confidence": "medium"
        },
        {
            "pattern": "Validate_Path(",
            "kind": "ioc:code_pattern",
            "file": "filemanager/UploadHandler.php",
            "line": 915,
            "snippet": "$dir = isset($_REQUEST['dir']) ? WDWLibrary::validate_path(WDWLibrary::get('dir', '', 'sanitize_text_field', 'REQUEST')) : '';",
            "confidence": "medium"
        },
        {
            "pattern": "Validate_Path(",
            "kind": "ioc:code_pattern",
            "file": "framework/WDWLibrary.php",
            "line": 3631,
            "snippet": "public static function validate_path( $path = '' ) {",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "55a3552b93ee701a8f4d46d0a6d6060a2c0b4aaf",
    "serial_offender_note": "Severity bumped high\u2192critical: author 10web has 6 prior security-issue closures on wp.org."
}

{
    "slug": "unlimited-elements-for-elementor",
    "finding_count": 17,
    "findings": [
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "inc_php/framework/zip.class.php",
            "line": 544,
            "snippet": "return gzinflate(substr($this->_data, $this->_metadata[$key]['_dataStart'], $this->_metadata[$key]['csize']));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/framework/image_proccess.class.php",
            "line": 545,
            "snippet": "$strPng = base64_decode($strPngData);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/framework/image_proccess.class.php",
            "line": 557,
            "snippet": "$strJpg = base64_decode($strJpgData);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/framework/functions.class.php",
            "line": 1379,
            "snippet": "$decoded = @base64_decode($content, true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/framework/functions.class.php",
            "line": 1538,
            "snippet": "$content = rawurldecode(base64_decode($content));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "inc_php/framework/functions.class.php",
            "line": 1568,
            "snippet": "$content = rawurldecode(base64_decode($content));",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "provider/wpml_integrate.class.php",
            "line": 282,
            "snippet": "eval($code);",
            "confidence": "medium"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "provider/provider_params_processor_multisource.class.php",
            "line": 166,
            "snippet": "$arrUsers = $this->objProcessor->getWPUsersData($this->arrValues, $paramUsers[\"name\"], $this->processType, $paramUsers);",
            "confidence": "high"
        },
        {
            "pattern": "createfunc",
            "kind": "builtin",
            "file": "provider/functions_wordpress.class.php",
            "line": 4546,
            "snippet": "add_action('widgets_init', create_function('', 'return register_widget(\"' . $widgetName . '\");'));",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "provider/core/plugins/unlimited_elements/helper_provider_core.class.php",
            "line": 188,
            "snippet": "eval($code);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "provider/core/plugins/unlimited_elements/elementor/elementor_integrate.class.php",
            "line": 229,
            "snippet": "eval($code);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "provider/core/plugins/unlimited_elements/elementor/elementor_integrate.class.php",
            "line": 264,
            "snippet": "eval($code);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "provider/core/unlimited_elements/helper_provider_core.class.php",
            "line": 196,
            "snippet": "eval($code);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "provider/core/unlimited_elements/elementor/elementor_integrate.class.php",
            "line": 241,
            "snippet": "eval($code);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "provider/core/unlimited_elements/elementor/elementor_integrate.class.php",
            "line": 276,
            "snippet": "eval($code);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "77c2cc84617563bddfc304361d80c4b8d209fc5f"
}

{
    "slug": "pagelayer",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "init.php",
            "line": 112,
            "snippet": "$pagelayer_updater = Pagelayer_PucFactory::buildUpdateChecker(PAGELAYER_API.'updates.php?version='.PAGELAYER_VERSION, PAGELAYER_FILE);",
            "confidence": "high",
            "details": {
                "url": null,
                "url_host": null,
                "slug_arg": null
            }
        }
    ],
    "resolved_sha": "fd45de38f3143a71e9b20c52c48c249d9e87cbd1"
}

{
    "slug": "mailpoet",
    "finding_count": 14,
    "findings": [
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/doctrine/common/src/Proxy/ProxyGenerator.php",
            "line": 169,
            "snippet": "eval(substr($proxyCode, 5));",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/twig/twig/src/Environment.php",
            "line": 184,
            "snippet": "eval('?>' . $content);",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor-prefixed/nesbot/carbon/src/Carbon/Traits/Mixin.php",
            "line": 33,
            "snippet": "$context = eval(self::getAnonymousClassCodeForTrait($trait));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/Router/Router.php",
            "line": 79,
            "snippet": "$data = !is_array($data) ? json_decode(base64_decode($data), true) : [];",
            "confidence": "medium"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/Newsletter/Scheduler/WelcomeScheduler.php",
            "line": 116,
            "snippet": "$segment = $this->segmentsRepository->getWPUsersSegment();",
            "confidence": "high"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/Form/Util/FieldNameObfuscator.php",
            "line": 31,
            "snippet": "$decoded = base64_decode(substr($name, strlen(self::OBFUSCATED_FIELD_PREFIX)));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/Statistics/Track/Opens.php",
            "line": 93,
            "snippet": "echo base64_decode('R0lGODlhAQABAJAAAP8AAAAAACH5BAUQAAAALAAAAAABAAEAAAICBAEAOw==');",
            "confidence": "medium"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/Config/Populator.php",
            "line": 357,
            "snippet": "$this->segmentsRepository->getWPUsersSegment();",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/AdminPages/PageRenderer.php",
            "line": 142,
            "snippet": "$wpSegment = $this->segmentRepository->getWPUsersSegment();",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/Subscribers/SubscribersRepository.php",
            "line": 568,
            "snippet": "$segmentId = $this->segmentsRepository->getWpUsersSegment()->getId();",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/Segments/WP.php",
            "line": 118,
            "snippet": "$wpSegment = $this->segmentsRepository->getWPUsersSegment();",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/Segments/WP.php",
            "line": 321,
            "snippet": "$wpSegment = $this->segmentsRepository->getWPUsersSegment();",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/Segments/WP.php",
            "line": 398,
            "snippet": "$wpSegment = $this->segmentsRepository->getWPUsersSegment();",
            "confidence": "high"
        },
        {
            "pattern": "getWPUsers",
            "kind": "ioc:code_pattern",
            "file": "lib/Segments/SegmentsRepository.php",
            "line": 76,
            "snippet": "public function getWPUsersSegment(): SegmentEntity {",
            "confidence": "high"
        }
    ],
    "resolved_sha": "e680db2c6a46f32e2f7718077d2d02511e5587ff"
}

{
    "slug": "duplicator",
    "finding_count": 7,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "classes/utilities/class.u.php",
            "line": 476,
            "snippet": "return base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Ajax/ServicesEducation.php",
            "line": 217,
            "snippet": "$encrypted = base64_decode($encryptedData);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/Headers/DupArchiveReaderGlobHeader.php",
            "line": 86,
            "snippet": "return ($isCompressed ? gzinflate($globContents) : $globContents);",
            "confidence": "medium"
        },
        {
            "pattern": "gzinflate",
            "kind": "builtin",
            "file": "src/Libs/DupArchive/DupArchiveExpandBasicEngine.php",
            "line": 252,
            "snippet": "$globContents = gzinflate($globContents);",
            "confidence": "medium"
        },
        {
            "pattern": "serialized_admin_role",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/config/class.conf.wp.php",
            "line": 22,
            "snippet": "const ADMIN_SERIALIZED_SECURITY_STRING = 'a:1:{s:13:\"administrator\";b:1;}';",
            "confidence": "high"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/class.crypt.php",
            "line": 33,
            "snippet": "$string = base64_decode($string);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "installer/dup-installer/classes/utilities/class.u.php",
            "line": 1391,
            "snippet": "$decoded = base64_decode($str, true);",
            "confidence": "medium"
        }
    ],
    "resolved_sha": "61a8ed704b64de3d0352e7c5f37648612842cfdf"
}

{
    "committer": "everpress",
    "member_since": "2016-12-14",
    "plugins_joined": 13,
    "spread_days": 0,
    "earliest_join": "2021-01-12 12:39:44",
    "latest_join": "2021-01-12 14:38:23",
    "combined_installs": 0,
    "sample_plugins": [
        {
            "slug": "google-analytics-for-mymail",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:34:07"
        },
        {
            "slug": "gravity-forms-mymail-add-on",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 12:39:44"
        },
        {
            "slug": "mymail-amazon-ses-integration",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:06:05"
        },
        {
            "slug": "mymail-contact-form-7",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:34:41"
        },
        {
            "slug": "mymail-cool-captcha",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:35:25"
        },
        {
            "slug": "mymail-dummy-mailer",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:35:41"
        },
        {
            "slug": "mymail-kickbox-io",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:36:43"
        },
        {
            "slug": "mymail-mandrill-integration",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:36:54"
        },
        {
            "slug": "mymail-multi-smtp",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:37:29"
        },
        {
            "slug": "mymail-recaptcha",
            "active_installs": 0,
            "first_commit_at": "2021-01-12 14:37:40"
        }
    ]
}

{
    "committer": "jthillithemes",
    "member_since": "2020-08-13",
    "plugins_joined": 15,
    "spread_days": 155,
    "earliest_join": "2021-04-12 15:55:39",
    "latest_join": "2021-09-15 02:36:08",
    "combined_installs": 10000,
    "sample_plugins": [
        {
            "slug": "restrict-content",
            "active_installs": 9000,
            "first_commit_at": "2021-04-12 15:55:39"
        },
        {
            "slug": "wpcomplete",
            "active_installs": 1000,
            "first_commit_at": "2021-08-24 20:21:24"
        },
        {
            "slug": "mail-chimp-add-on-for-restrict-content-pro",
            "active_installs": 0,
            "first_commit_at": "2021-09-15 02:36:08"
        },
        {
            "slug": "rcp-authorize-net",
            "active_installs": 0,
            "first_commit_at": "2021-09-15 00:56:22"
        },
        {
            "slug": "rcp-edd-member-downloads",
            "active_installs": 0,
            "first_commit_at": "2021-09-14 20:02:57"
        },
        {
            "slug": "rcp-edd-wallet",
            "active_installs": 0,
            "first_commit_at": "2021-09-14 21:38:36"
        },
        {
            "slug": "rcp-limited-quantity-available",
            "active_installs": 0,
            "first_commit_at": "2021-09-14 18:26:03"
        },
        {
            "slug": "rcp-strong-passwords",
            "active_installs": 0,
            "first_commit_at": "2021-09-14 20:51:44"
        },
        {
            "slug": "restrict-content-pro-bbpress",
            "active_installs": 0,
            "first_commit_at": "2021-09-14 20:23:04"
        },
        {
            "slug": "restrict-content-pro-campaign-monitor",
            "active_installs": 0,
            "first_commit_at": "2021-05-27 17:52:49"
        }
    ]
}

{
    "committer": "xadapter",
    "member_since": "2016-05-26",
    "plugins_joined": 14,
    "spread_days": 1,
    "earliest_join": "2017-04-26 13:06:24",
    "latest_join": "2017-04-28 03:38:44",
    "combined_installs": 90000,
    "sample_plugins": [
        {
            "slug": "product-import-export-for-woo",
            "active_installs": 90000,
            "first_commit_at": "2017-04-26 13:06:24"
        },
        {
            "slug": "bundle-rate-addon-for-woocommerce-shipping-pro",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 02:42:23"
        },
        {
            "slug": "canada-post-woocommerce-shipping",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 03:24:31"
        },
        {
            "slug": "dhl-woocommerce-shipping-method",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 02:44:52"
        },
        {
            "slug": "fedex-woocommerce-shipping-method",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 02:53:19"
        },
        {
            "slug": "per-product-addon-for-woocommerce-shipping-pro",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 03:13:21"
        },
        {
            "slug": "shipping-labels-for-woo",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 03:29:56"
        },
        {
            "slug": "ups-woocommerce-shipping-method",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 03:19:36"
        },
        {
            "slug": "weight-country-woocommerce-shipping",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 03:32:58"
        },
        {
            "slug": "woo-australia-post-shipping-method",
            "active_installs": 0,
            "first_commit_at": "2017-04-28 03:22:03"
        }
    ]
}

{
    "committer": "adaptxy",
    "member_since": "2018-02-21",
    "plugins_joined": 13,
    "spread_days": 0,
    "earliest_join": "2018-08-30 10:30:23",
    "latest_join": "2018-08-31 10:23:22",
    "combined_installs": 0,
    "sample_plugins": [
        {
            "slug": "bulk-edit-products-prices-and-attributes-for-woocommerce",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 10:30:23"
        },
        {
            "slug": "dhl-woocommerce-shipping-method",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 11:50:42"
        },
        {
            "slug": "dynamic-pricing-and-discounts-for-woocommerce-basic-version",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 12:19:24"
        },
        {
            "slug": "eh-ajax-search",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 12:34:55"
        },
        {
            "slug": "optimise-youtube-video-embed",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 12:26:51"
        },
        {
            "slug": "payment-gateway-authorizenet-woocommerce",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 10:45:26"
        },
        {
            "slug": "payments-gateway-amazon-woocommerce",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 11:17:20"
        },
        {
            "slug": "prices-by-user-role",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 11:24:13"
        },
        {
            "slug": "woo-australia-post-shipping-method",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 11:34:09"
        },
        {
            "slug": "woo-easypost-shipping-method",
            "active_installs": 0,
            "first_commit_at": "2018-08-30 11:26:42"
        }
    ]
}

{
    "committer": "dgewirtz",
    "member_since": "2009-11-30",
    "plugins_joined": 10,
    "spread_days": 28,
    "earliest_join": "2015-03-17 00:13:32",
    "latest_join": "2015-04-14 02:15:57",
    "combined_installs": 32000,
    "sample_plugins": [
        {
            "slug": "jonradio-private-site",
            "active_installs": 20000,
            "first_commit_at": "2015-04-14 02:07:42"
        },
        {
            "slug": "jonradio-multiple-themes",
            "active_installs": 10000,
            "first_commit_at": "2015-04-14 02:08:36"
        },
        {
            "slug": "seamless-donations",
            "active_installs": 2000,
            "first_commit_at": "2015-03-17 00:13:32"
        },
        {
            "slug": "better-recent-posts-widget",
            "active_installs": 0,
            "first_commit_at": "2015-03-19 01:32:39"
        },
        {
            "slug": "jonradio-current-year-and-copyright-shortcodes",
            "active_installs": 0,
            "first_commit_at": "2015-04-14 02:09:18"
        },
        {
            "slug": "jonradio-display-kitchen-sink",
            "active_installs": 0,
            "first_commit_at": "2015-04-14 02:15:57"
        },
        {
            "slug": "jonradio-perpetual-calendar",
            "active_installs": 0,
            "first_commit_at": "2015-04-14 02:08:09"
        },
        {
            "slug": "jonradio-remember-me",
            "active_installs": 0,
            "first_commit_at": "2015-04-14 02:07:14"
        },
        {
            "slug": "jonradio-reveal-network-activated-plugins",
            "active_installs": 0,
            "first_commit_at": "2015-04-14 02:06:37"
        },
        {
            "slug": "jonradio-shortcodes-anywhere-or-everywhere",
            "active_installs": 0,
            "first_commit_at": "2015-04-14 02:06:07"
        }
    ],
    "triage_note_2026_05_03": "David Gewirtz (real person, ZDNet writer). All slugs are jonradio-* family; his original 2015 publishing burst."
}

{
    "slug": "usetiful-digital-adoption-platform",
    "committer": "komalusetiful",
    "display_name": "komalusetiful",
    "member_since": "2025-01-31",
    "first_commit_at": "2025-02-06 19:05:50",
    "account_age_at_first_commit": 6,
    "commit_count": 4,
    "active_installs": 100
}

{
    "slug": "payday",
    "committer": "kristinnbjorgvins",
    "display_name": "kristinnbjorgvins",
    "member_since": "2024-09-23",
    "first_commit_at": "2024-10-09 11:19:47",
    "account_age_at_first_commit": 16,
    "commit_count": 11,
    "active_installs": 100
}

{
    "slug": "marketing-automation-and-personalization",
    "committer": "aconvesio",
    "display_name": "convesio-developer",
    "member_since": "2025-07-07",
    "first_commit_at": "2025-07-09 09:32:56",
    "account_age_at_first_commit": 2,
    "commit_count": 13,
    "active_installs": 100
}

{
    "slug": "eucookielaw",
    "committer": "gabrieleromanatoaxio",
    "display_name": "Gabriele Romanato",
    "member_since": "2025-05-06",
    "first_commit_at": "2025-05-07 07:40:26",
    "account_age_at_first_commit": 1,
    "commit_count": 10,
    "active_installs": 200
}

{
    "slug": "wc-payconiq",
    "committer": "nvwp",
    "display_name": "Nvision",
    "member_since": "2025-04-01",
    "first_commit_at": "2025-04-03 08:11:36",
    "account_age_at_first_commit": 2,
    "commit_count": 3,
    "active_installs": 200
}

{
    "slug": "server-info-for-debugging",
    "committer": "mandeeps1987",
    "display_name": "mandeeps1987",
    "member_since": "2026-02-11",
    "first_commit_at": "2026-02-11 19:27:07",
    "account_age_at_first_commit": 0,
    "commit_count": 1,
    "active_installs": 200
}

{
    "slug": "preloader-for-divi",
    "committer": "wpmariocom",
    "display_name": "wpmariocom",
    "member_since": "2024-09-24",
    "first_commit_at": "2024-09-25 08:35:31",
    "account_age_at_first_commit": 1,
    "commit_count": 6,
    "active_installs": 200
}

{
    "slug": "ez-countdown-timer",
    "committer": "mandeeps1987",
    "display_name": "mandeeps1987",
    "member_since": "2026-02-11",
    "first_commit_at": "2026-02-11 19:09:24",
    "account_age_at_first_commit": 0,
    "commit_count": 15,
    "active_installs": 200
}

{
    "slug": "link-to-bible",
    "committer": "erfonlinedev",
    "display_name": "ERF",
    "member_since": "2024-08-15",
    "first_commit_at": "2024-08-25 12:53:39",
    "account_age_at_first_commit": 10,
    "commit_count": 13,
    "active_installs": 200
}

{
    "slug": "pro-reports-for-memberpress",
    "committer": "hassanhashmi9",
    "display_name": "Hassan HAshmi",
    "member_since": "2025-05-13",
    "first_commit_at": "2025-05-13 20:11:21",
    "account_age_at_first_commit": 0,
    "commit_count": 3,
    "active_installs": 100
}

{
    "slug": "talentlms",
    "committer": "wptalentlms",
    "display_name": "wptalentlms",
    "member_since": "2025-10-22",
    "first_commit_at": "2025-11-06 08:44:48",
    "account_age_at_first_commit": 15,
    "commit_count": 1,
    "active_installs": 300
}

{
    "slug": "a2z-fedex-shipping",
    "committer": "aarsiv",
    "display_name": "Aarsiv Groups",
    "member_since": "2024-07-01",
    "first_commit_at": "2024-07-12 18:02:14",
    "account_age_at_first_commit": 11,
    "commit_count": 47,
    "active_installs": 200
}

{
    "slug": "listings-for-appfolio",
    "committer": "listingsappfolio",
    "display_name": "Listings for Appfolio",
    "member_since": "2025-07-12",
    "first_commit_at": "2025-07-12 06:59:19",
    "account_age_at_first_commit": 0,
    "commit_count": 2,
    "active_installs": 200
}

{
    "slug": "fewer-tags",
    "committer": "progressplanner",
    "display_name": "Progress Planner",
    "member_since": "2025-01-29",
    "first_commit_at": "2025-03-10 12:15:27",
    "account_age_at_first_commit": 40,
    "commit_count": 3,
    "active_installs": 200
}

{
    "slug": "a2z-dhl-express-shipping",
    "committer": "aarsiv",
    "display_name": "Aarsiv Groups",
    "member_since": "2024-07-01",
    "first_commit_at": "2024-07-02 05:01:32",
    "account_age_at_first_commit": 1,
    "commit_count": 17,
    "active_installs": 100
}