WP Beacon
Critical code_pattern
Resolved · fp_legacy_code_pattern_lowinstalls
2026-10-06 05:05:53 (14d ago)
| Slug | stripe-frontend-registration |
|---|---|
| Pattern | direct_user_insert |
| Kind | builtin |
| Version | 1.1 |
| Hit count | 1 |
| First hit |
|
| Explanation | plugin issues a SQL `INSERT INTO ...users (user_login, user_pass, ...)` — bypassing `wp_create_user()`/`wp_insert_user()` to add an account with attacker-controlled credentials. Combined with `serialized_admin_role` this is the textbook hidden-administrator persistence used by the June 2024 credential-stuffing wave. |
View raw JSON
{
"slug": "stripe-frontend-registration",
"pattern": "direct_user_insert",
"kind": "builtin",
"version": "1.1",
"hit_count": 1,
"first_hit": {
"file": "registration_stripe_form.php",
"line": 133,
"snippet": "$insertquery='insert into wp_users (user_login,user_pass,user_nicename,user_email,user_url,user_registered,user_activation_key,user_status,display_name)"
},
"explanation": "plugin issues a SQL `INSERT INTO ...users (user_login, user_pass, ...)` \u2014 bypassing `wp_create_user()`/`wp_insert_user()` to add an account with attacker-controlled credentials. Combined with `serialized_admin_role` this is the textbook hidden-administrator persistence used by the June 2024 credential-stuffing wave."
}