WP Beacon
Critical code_pattern
Resolved · fp_dropper_hardcoded_core_include_png_import
2026-07-03 18:42:12 (19d ago)
| Slug | groovy-menu-free |
|---|---|
| Pattern | decode_write_dropper |
| Kind | builtin |
| Version | 1.4.8 |
| Hit count | 1 |
| First hit |
|
| Explanation | a runtime decode primitive (`gzuncompress`/`gzinflate`/`gzdecode`/`base64_decode`) feeds a filesystem write (`fwrite`/`file_put_contents`) which is then `include`d/`require`d as a variable path — the textbook dropper shape: ship an encoded payload as data, decode it to disk at activation/admin-init, and execute it. The siteguarding burner `wp-plugin-management` (audit #43) used exactly this: `fwrite($fp, gzuncompress($c)); include($filename);` in its `register_activation_hook` to plant `siteguarding_tools.php`. Near-zero FP because legit caching writes decoded data but never `include`s a computed path it just wrote. |
View raw JSON
{
"slug": "groovy-menu-free",
"pattern": "decode_write_dropper",
"kind": "builtin",
"version": "1.4.8",
"hit_count": 1,
"first_hit": {
"file": "includes/modules/core/inc/GroovyMenuSettings.php",
"line": 1177,
"snippet": "$tmpFile = file_put_contents( $filename, base64_decode( $value['data'] ) );"
},
"explanation": "a runtime decode primitive (`gzuncompress`/`gzinflate`/`gzdecode`/`base64_decode`) feeds a filesystem write (`fwrite`/`file_put_contents`) which is then `include`d/`require`d as a variable path \u2014 the textbook dropper shape: ship an encoded payload as data, decode it to disk at activation/admin-init, and execute it. The siteguarding burner `wp-plugin-management` (audit #43) used exactly this: `fwrite($fp, gzuncompress($c)); include($filename);` in its `register_activation_hook` to plant `siteguarding_tools.php`. Near-zero FP because legit caching writes decoded data but never `include`s a computed path it just wrote."
}