Welcart e-Commerce

{
    "slug": "usc-e-shop",
    "finding_count": 471,
    "findings": [
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tags/2.9.2/functions/filters.php",
            "line": 1799,
            "snippet": "wp_enqueue_script( 'usces_ajaxzip3', 'https://ajaxzip3.github.io/ajaxzip3.js', array(), current_time( 'timestamp' ), false );",
            "confidence": "medium",
            "details": {
                "url": "https://ajaxzip3.github.io/ajaxzip3.js",
                "url_host": "ajaxzip3.github.io"
            }
        },
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "tags/2.9.2/includes/update_check.php",
            "line": 91,
            "snippet": "$$slug     = Puc_v4_Factory::buildUpdateChecker( $json_path, $fullpath, $slug );",
            "confidence": "high",
            "details": {
                "url": null,
                "url_host": null,
                "slug_arg": null
            }
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "tags/1.7.3/classes/usceshop.class.php",
            "line": 1727,
            "snippet": "$options['acting_settings']['mizuho']['send_url_test'] = \"https://210.161.141.207/mltbank/MBWebFrontPayment\";",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "tags/1.7.3/classes/usceshop.class.php",
            "line": 1728,
            "snippet": "if( defined('WCEX_MOBILE') ) $options['acting_settings']['mizuho']['send_url_mbl_test'] = \"https://210.161.141.207/mltbank/iMBWebFrontPayment\";",
            "confidence": "high"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tags/1.7.3/functions/filters.php",
            "line": 1399,
            "snippet": "wp_enqueue_script( 'usces_ajaxzip3', \"https://ajaxzip3.github.io/ajaxzip3.js\" );",
            "confidence": "medium",
            "details": {
                "url": "https://ajaxzip3.github.io/ajaxzip3.js",
                "url_host": "ajaxzip3.github.io"
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tags/1.9.25/functions/filters.php",
            "line": 1308,
            "snippet": "wp_enqueue_script( 'usces_ajaxzip3', \"https://ajaxzip3.github.io/ajaxzip3.js\" );",
            "confidence": "medium",
            "details": {
                "url": "https://ajaxzip3.github.io/ajaxzip3.js",
                "url_host": "ajaxzip3.github.io"
            }
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "tags/1.6/classes/usceshop.class.php",
            "line": 1697,
            "snippet": "$options['acting_settings']['mizuho']['send_url_test'] = \"https://210.161.141.207/mltbank/MBWebFrontPayment\";",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "tags/1.6/classes/usceshop.class.php",
            "line": 1698,
            "snippet": "if( defined('WCEX_MOBILE') ) $options['acting_settings']['mizuho']['send_url_mbl_test'] = \"https://210.161.141.207/mltbank/iMBWebFrontPayment\";",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "tags/1.3.10.2/classes/usceshop.class.php",
            "line": 1553,
            "snippet": "$options['acting_settings']['mizuho']['send_url_test'] = \"https://210.161.141.207/mltbank/MBWebFrontPayment\";",
            "confidence": "high"
        },
        {
            "pattern": "hardcoded_ip_url",
            "kind": "builtin",
            "file": "tags/1.3.10.2/classes/usceshop.class.php",
            "line": 1554,
            "snippet": "if( defined('WCEX_MOBILE') ) $options['acting_settings']['mizuho']['send_url_mbl_test'] = \"https://210.161.141.207/mltbank/iMBWebFrontPayment\";",
            "confidence": "high"
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tags/2.8.20/functions/filters.php",
            "line": 1784,
            "snippet": "wp_enqueue_script( 'usces_ajaxzip3', 'https://ajaxzip3.github.io/ajaxzip3.js', array(), current_time( 'timestamp' ), false );",
            "confidence": "medium",
            "details": {
                "url": "https://ajaxzip3.github.io/ajaxzip3.js",
                "url_host": "ajaxzip3.github.io"
            }
        },
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "tags/2.8.20/includes/update_check.php",
            "line": 91,
            "snippet": "$$slug     = Puc_v4_Factory::buildUpdateChecker( $json_path, $fullpath, $slug );",
            "confidence": "high",
            "details": {
                "url": null,
                "url_host": null,
                "slug_arg": null
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tags/2.11.8/functions/filters.php",
            "line": 1815,
            "snippet": "wp_enqueue_script( 'usces_ajaxzip3', 'https://ajaxzip3.github.io/ajaxzip3.js', array(), current_time( 'timestamp' ), false );",
            "confidence": "medium",
            "details": {
                "url": "https://ajaxzip3.github.io/ajaxzip3.js",
                "url_host": "ajaxzip3.github.io"
            }
        },
        {
            "pattern": "puc_update_hijack",
            "kind": "builtin",
            "file": "tags/2.11.8/includes/update_check.php",
            "line": 194,
            "snippet": "$$slug     = Puc_v4_Factory::buildUpdateChecker( $json_path, $fullpath, $slug );",
            "confidence": "high",
            "details": {
                "url": null,
                "url_host": null,
                "slug_arg": null
            }
        },
        {
            "pattern": "remote_enqueue",
            "kind": "builtin",
            "file": "tags/2.8.3/functions/filters.php",
            "line": 1730,
            "snippet": "wp_enqueue_script( 'usces_ajaxzip3', \"https://ajaxzip3.github.io/ajaxzip3.js\" );",
            "confidence": "medium",
            "details": {
                "url": "https://ajaxzip3.github.io/ajaxzip3.js",
                "url_host": "ajaxzip3.github.io"
            }
        }
    ],
    "resolved_sha": "907d4df9ce22d49fedd098f4cbffae6b8349dad5"
}

{
    "slug": "usc-e-shop",
    "pattern": "puc_update_hijack",
    "kind": "builtin",
    "version": "2.11.28",
    "hit_count": 1,
    "first_hit": {
        "file": "includes/update_check.php",
        "line": 194,
        "snippet": "$$slug     = Puc_v4_Factory::buildUpdateChecker( $json_path, $fullpath, $slug );"
    },
    "explanation": "plugin calls `::buildUpdateChecker()` \u2014 the factory entry point of the Yahnis Elsts Plugin Update Checker library. A plugin distributed through wordpress.org that registers its own update source is bypassing the Plugin Review Team: every install polls the non-wp.org URL on cron and installs whatever JSON + zip it returns, with full plugin-author permissions. This is the mechanism behind the `anadnet`/quick-pagepost-redirect-plugin compromise (2021) where the author seeded 70,000+ installs through tagged releases and then removed the library from trunk to hide the persistence. Any URL argument pointing away from `downloads.wordpress.org`/`api.wordpress.org` is the hijack signal.",
    "shape": "unparseable",
    "url": null,
    "url_host": null,
    "slug_arg": null
}