Barcode Generator for WooCommerce – Show barcodes on products, orders, invoices and other pages

embedding-barcodes-into-product-pages-and-orders · by ukrsolution · wordpress.org ↗ · SVN ↗
This plugin is closed on wordpress.org. Closed 2026-07-16. Temporary closure — pending a full review by wp.org.
Active installs
300
Current version
2.0.5
Added
Last updated
First seen by beacon
4mo ago
Total downloads

Statistics

2024-06-17 → 2026-07-14 · 758 days
Downloads today
6
7-day total 29
Week over week
▼ -3%
vs prior 7 days
30-day trend
flat
▲ +11% MoM
Abandonment
●○○○○
install base on one version
Downloads/day Linear trend
196147984902024-062024-102025-022025-062025-112026-032026-07
5844291502026-042026-052026-052026-052026-062026-06
5844291502026-062026-062026-062026-062026-072026-07

Active versions

2.0
2.0 · 100.0%

Ratings

5★
17
4★
0
3★
0
2★
0
1★
4

Support: 0/0 resolved

Alerts (0)

No open alerts.

Show 2 resolved alerts
Low plugin_closed Resolved · observed_temporary_closure 2026-07-27 01:40:10 (27d ago)
Slugembedding-barcodes-into-product-pages-and-orders
Closed reasontemporary
Closed date2026-07-16 00:00:00
Active installs300
View raw JSON
{
    "slug": "embedding-barcodes-into-product-pages-and-orders",
    "closed_reason": "temporary",
    "closed_date": "2026-07-16 00:00:00",
    "active_installs": 300
}
Critical code_pattern Resolved · wpautoupdate_library_vendored_fp 2026-05-08 09:56:55 (3mo ago)
Slugembedding-barcodes-into-product-pages-and-orders
Patternunserialize_after_remote_call
Kindbuiltin
Version2.0.5
Hit count1
First hit
File
class/Updater/WpAutoUpdate.php
Line
148
Snippet
L145: $request = wp_remote_post($this->update_path, $params); → L148: $serverData = @unserialize($request['body']);
Explanationa remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file — classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised.
View raw JSON
{
    "slug": "embedding-barcodes-into-product-pages-and-orders",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "2.0.5",
    "hit_count": 1,
    "first_hit": {
        "file": "class/Updater/WpAutoUpdate.php",
        "line": 148,
        "snippet": "L145: $request = wp_remote_post($this->update_path, $params);  \u2192  L148: $serverData = @unserialize($request['body']);"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}

SVN committers (2)

Accounts with actual commit access to embedding-barcodes-into-product-pages-and-orders on plugins.svn.wordpress.org, reconstructed from svn log. This is the list that matters for ownership changes — not the readme contributors.

Committer Member since Commits First commit Latest commit
ukrsolution 2016-01-08 55 2021-04-29 · r2523206 2025-07-28 · r3335207
plugin-master 2007-03-09 1 2021-04-28 · r2522892 2021-04-28 · r2522892

Readme contributors (1)

Names the plugin's readme declares as contributors. A soft signal — anyone can be listed. The SVN access column is the ground-truth cross-reference: does this contributor actually commit code?

Contributor Member since SVN access Status
ukrsolution 2016-01-08 55 commits Active