Nexter Extension – Security, Performance, Code Snippets & Site Toolkit

{
    "slug": "nexter-extension",
    "previous_version": "4.7.1",
    "current_version": "4.7.8",
    "new_findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "include/classes/class-nxt-secret.php",
            "line": 129,
            "snippet": "$raw = base64_decode( substr( $stored, strlen( self::PREFIX ) ), true );",
            "confidence": "medium"
        }
    ],
    "new_finding_count": 1
}

{
    "slug": "nexter-extension",
    "previous_version": "4.6.11",
    "current_version": "4.6.15",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 806,
            "snippet": "L796: $response = wp_remote_post($theme_api_url, $args);  \u2192  L806: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 898,
            "snippet": "L897: $body = wp_remote_retrieve_body( $response );  \u2192  L898: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}

{
    "slug": "nexter-extension",
    "previous_version": "4.6.10",
    "current_version": "4.6.11",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 782,
            "snippet": "L772: $response = wp_remote_post($theme_api_url, $args);  \u2192  L782: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 874,
            "snippet": "L873: $body = wp_remote_retrieve_body( $response );  \u2192  L874: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 2
}

{
    "slug": "nexter-extension",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "4.6.8",
    "hit_count": 2,
    "first_hit": {
        "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
        "line": 779,
        "snippet": "L769: $response = wp_remote_post($theme_api_url, $args);  \u2192  L779: $theme_info = @unserialize( $body );"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}

{
    "slug": "nexter-extension",
    "previous_version": "4.6.7",
    "current_version": "4.6.8",
    "new_findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "include/panel-settings/extensions/nexter-ext-adobe-font.php",
            "line": 190,
            "snippet": "wp_enqueue_style( 'nexter-adobe-typekit','https://use.typekit.net/'.esc_attr($font_val['project_id']).'.css', [], NEXTER_EXT_VER );",
            "confidence": "medium",
            "details": {
                "url": "https://use.typekit.net/",
                "url_host": "use.typekit.net"
            }
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 779,
            "snippet": "L769: $response = wp_remote_post($theme_api_url, $args);  \u2192  L779: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 871,
            "snippet": "L870: $body = wp_remote_retrieve_body( $response );  \u2192  L871: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 3
}

{
    "slug": "nexter-extension",
    "finding_count": 3,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 779,
            "snippet": "L769: $response = wp_remote_post($theme_api_url, $args);  \u2192  L779: $theme_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "include/panel-settings/class-nxt-panel-ajax-router.php",
            "line": 871,
            "snippet": "L870: $body = wp_remote_retrieve_body( $response );  \u2192  L871: $plugin_info = @unserialize( $body );",
            "confidence": "high"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "include/panel-settings/extensions/nexter-ext-adobe-font.php",
            "line": 190,
            "snippet": "wp_enqueue_style( 'nexter-adobe-typekit','https://use.typekit.net/'.esc_attr($font_val['project_id']).'.css', [], NEXTER_EXT_VER );",
            "confidence": "medium",
            "details": {
                "url": "https://use.typekit.net/",
                "url_host": "use.typekit.net"
            }
        }
    ],
    "resolved_sha": "20dc3c2b4ca1db5173676e40fea3b86880ee9bb2"
}