WP Beacon
Critical code_pattern
Resolved · fp_legacy_code_pattern_lowinstalls
2026-10-06 12:07:40 (12d ago)
| Slug | corona-test-results |
|---|---|
| Pattern | decode_write_dropper |
| Kind | builtin |
| Version | 1.11.6 |
| Hit count | 1 |
| First hit |
|
| Explanation | a runtime decode primitive (`gzuncompress`/`gzinflate`/`gzdecode`/`base64_decode`) feeds a filesystem write (`fwrite`/`file_put_contents`) which is then `include`d/`require`d as a variable path — the textbook dropper shape: ship an encoded payload as data, decode it to disk at activation/admin-init, and execute it. The siteguarding burner `wp-plugin-management` (audit #43) used exactly this: `fwrite($fp, gzuncompress($c)); include($filename);` in its `register_activation_hook` to plant `siteguarding_tools.php`. Near-zero FP because legit caching writes decoded data but never `include`s a computed path it just wrote. |
View raw JSON
{
"slug": "corona-test-results",
"pattern": "decode_write_dropper",
"kind": "builtin",
"version": "1.11.6",
"hit_count": 1,
"first_hit": {
"file": "corona-test-results-admin-settings.php",
"line": 1198,
"snippet": "define( \\'CTR_ENCRYPTION_KEY\\', base64_decode( \\'' . base64_encode( DataEncryption::getRandomKey() ) . '\\' ) );';"
},
"explanation": "a runtime decode primitive (`gzuncompress`/`gzinflate`/`gzdecode`/`base64_decode`) feeds a filesystem write (`fwrite`/`file_put_contents`) which is then `include`d/`require`d as a variable path \u2014 the textbook dropper shape: ship an encoded payload as data, decode it to disk at activation/admin-init, and execute it. The siteguarding burner `wp-plugin-management` (audit #43) used exactly this: `fwrite($fp, gzuncompress($c)); include($filename);` in its `register_activation_hook` to plant `siteguarding_tools.php`. Near-zero FP because legit caching writes decoded data but never `include`s a computed path it just wrote."
}