Active-install and ratings figures are the last values WP Beacon captured before wordpress.org closed this plugin — wp.org no longer publishes them. Daily downloads are still updated.
No ratings data.
No open alerts.
| Slug | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
|---|---|
| Closed reason | temporary |
| Closed date | 2026-07-16 00:00:00 |
| Active installs | 1,000 |
WP Beacon
{
"slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
"closed_reason": "temporary",
"closed_date": "2026-07-16 00:00:00",
"active_installs": 1000
}| Slug | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
|---|---|
| Pattern | unserialize_after_remote_call |
| Kind | builtin |
| Version | 1.12.1 |
| Hit count | 1 |
| First hit |
|
| Explanation | a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised. |
{
"slug": "barcode-scanner-lite-pos-to-manage-products-inventory-and-orders",
"pattern": "unserialize_after_remote_call",
"kind": "builtin",
"version": "1.12.1",
"hit_count": 1,
"first_hit": {
"file": "src/features/updater/WpAutoUpdate.php",
"line": 149,
"snippet": "L146: $request = wp_remote_post($this->update_path, $params); \u2192 L149: $serverData = @unserialize($request['body']);"
},
"explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}Accounts with actual commit access to barcode-scanner-lite-pos-to-manage-products-inventory-and-orders on plugins.svn.wordpress.org, reconstructed from svn log. This is the list that matters for ownership changes — not the readme contributors.
| Committer | Member since | Commits | First commit | Latest commit |
|---|---|---|---|---|
| Dmitry V. (CEO of "UKR Solution") | 2016-01-08 | 154 | 2021-08-03 · r2577245 | 2026-05-12 · r3529543 |
| plugin-master | 2007-03-09 | 1 | 2021-07-15 · r2564695 | 2021-07-15 · r2564695 |
Names the plugin's readme declares as contributors. A soft signal — anyone can be listed. The SVN access column is the ground-truth cross-reference: does this contributor actually commit code?
| Contributor | Member since | SVN access | Status |
|---|---|---|---|
| Dmitry V. (CEO of "UKR Solution") | 2016-01-08 | 154 commits | Active |