Wordfence Security – Firewall, Malware Scan, and Login Security

{
    "slug": "wordfence",
    "finding_count": 37,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfActivityReport.php",
            "line": 592,
            "snippet": "$paramKey = base64_decode($actionData['paramKey']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfActivityReport.php",
            "line": 593,
            "snippet": "$paramValue = base64_decode($actionData['paramValue']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfUtils.php",
            "line": 3791,
            "snippet": "$intermediate = base64_decode($intermediate);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 21,
            "snippet": "$decodedHeader = base64_decode($header);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 32,
            "snippet": "$decodedBody = base64_decode($body);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 91,
            "snippet": "$decodedHeader = base64_decode($header);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 107,
            "snippet": "$decodedBody = base64_decode($body);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfJWT.php",
            "line": 179,
            "snippet": "return base64_decode(strtr($data, '-_', '+/'));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceURLHoover.php",
            "line": 604,
            "snippet": "$skipList = new wfBinaryList(base64_decode(wfConfig::get('wfsbskip', '')));",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wfLog.php",
            "line": 1356,
            "snippet": "$actionData[$key] = base64_decode($actionData[$key]);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 1182,
            "snippet": "$iwpRequest = json_decode(trim(base64_decode($iwpRequestDataArray[1])), true);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 7588,
            "snippet": "$waf->whitelistRuleForParam(base64_decode($_POST['path']), base64_decode($_POST['paramKey']),",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 8116,
            "snippet": "$paramKey = base64_decode($actionData['paramKey']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 8117,
            "snippet": "$paramValue = base64_decode($actionData['paramValue']);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "lib/wordfenceClass.php",
            "line": 8356,
            "snippet": "$value['path'] = base64_decode($path);",
            "confidence": "medium"
        }
    ],
    "triage_note_2026_05_03": "wordfence: 37 base64_decode hits, all in legitimate JWT decode (lib/wfJWT.php), activity-report parameters, URL hoover skip-list. Standard security-plugin internals."
}

{
    "slug": "wordfence",
    "committer_slug": "wfmatt",
    "committer_display_name": "wfmatt",
    "committer_employer": null,
    "committer_member_since": "2014-12-21",
    "committer_first_commit": "2014-12-22 03:10:09",
    "committer_commit_count": 28,
    "plugin_listed_author": "mmaunder",
    "earliest_plugin_commit": "2011-09-04 10:09:14",
    "plugin_age_at_join_days": 1204,
    "committer_age_at_join_days": 1,
    "active_installs": 5000000
}