WP Beacon
Critical code_pattern
Resolved · audit:suspicious
2026-05-08 09:56:56 (1mo ago)
| Slug | country-caching-extension-for-wp-super-cache |
|---|---|
| Pattern | puc_update_hijack |
| Kind | builtin |
| Version | 0.8.0 |
| Hit count | 1 |
| First hit |
|
| Explanation | plugin calls `::buildUpdateChecker()` — the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal. |
| Shape | hijack |
| Url | http://blog.XXXXXXXX.com/meta_ccwpsc.json |
| Url host | blog.XXXXXXXX.com |
| Slug arg | country-caching-extension-for-wp-super-cache |
View raw JSON
{
"slug": "country-caching-extension-for-wp-super-cache",
"pattern": "puc_update_hijack",
"kind": "builtin",
"version": "0.8.0",
"hit_count": 1,
"first_hit": {
"file": "cc_wpsc_init.php",
"line": 17,
"snippet": "$myUpdateChecker = Puc_v4_Factory::buildUpdateChecker("
},
"explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
"shape": "hijack",
"url": "http://blog.XXXXXXXX.com/meta_ccwpsc.json",
"url_host": "blog.XXXXXXXX.com",
"slug_arg": "country-caching-extension-for-wp-super-cache"
}