Starter Sites & Templates by Neve

{
    "slug": "templates-patterns-collection",
    "finding_count": 1,
    "findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/TI_Beaver.php",
            "line": 167,
            "snippet": "L148: $response = wp_remote_get( esc_url_raw( $url ) );  \u2192  L167: if ( @unserialize( $serialized_string ) !== true && preg_match( '/^[aOs]:/', $serialized",
            "confidence": "high"
        }
    ],
    "resolved_sha": "9d5e8bf99105ec63a2a55513062262777d7a98bb"
}

{
    "slug": "templates-patterns-collection",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "1.2.27",
    "hit_count": 1,
    "first_hit": {
        "file": "includes/TI_Beaver.php",
        "line": 167,
        "snippet": "L148: $response = wp_remote_get( esc_url_raw( $url ) );  \u2192  L167: if ( @unserialize( $serialized_string ) !== true && preg_match( '/^[aOs]:/', $serialized"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*` / `curl_exec`) is followed by `@unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget. The error-suppressed form is the tell: legit code wants to know when deserialize fails; attackers suppress so malformed gadgets do not leak. A real finding regardless of author intent: any plugin that deserializes remote responses without validation is a latent RCE chain if the remote endpoint is ever compromised."
}

{
    "slug": "templates-patterns-collection",
    "previous_version": "1.2.27",
    "current_version": "1.2.27",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "includes/TI_Beaver.php",
            "line": 167,
            "snippet": "L148: $response = wp_remote_get( esc_url_raw( $url ) );  \u2192  L167: if ( @unserialize( $serialized_string ) !== true && preg_match( '/^[aOs]:/', $serialized",
            "confidence": "high"
        }
    ],
    "new_finding_count": 1
}

{
    "slug": "templates-patterns-collection",
    "domain": "themeisle.link",
    "domain_source": "c2_http_call",
    "domain_registered_at": "2025-05-13",
    "plugin_earliest_commit": "2020-07-27 19:07:48",
    "plugin_latest_release": "2026-04-23 13:16:22",
    "gap_days": 1750,
    "domain_age_at_release": 345,
    "active_installs": 100000
}