WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

{
    "slug": "wpforms-lite",
    "finding_count": 11,
    "findings": [
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "includes/class-process.php",
            "line": 1348,
            "snippet": "$query_args = base64_decode( $hash );",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/VarParser/Native.php",
            "line": 30,
            "snippet": "$result = eval(\"\\$var = {$expr};\");",
            "confidence": "medium"
        },
        {
            "pattern": "eval_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/ConfigSchema/InterchangeBuilder.php",
            "line": 157,
            "snippet": "return eval('return array(' . $contents . ');');",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/URIScheme/data.php",
            "line": 81,
            "snippet": "$raw_data = \\base64_decode($data);",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Tasks/Meta.php",
            "line": 227,
            "snippet": "$decoded = base64_decode( $meta->data );",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Helpers/Crypto.php",
            "line": 27,
            "snippet": "return base64_decode( $secret_key ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode",
            "confidence": "medium"
        },
        {
            "pattern": "base64_decode",
            "kind": "builtin",
            "file": "src/Helpers/Crypto.php",
            "line": 91,
            "snippet": "$decoded = base64_decode( (string) $encrypted ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode",
            "confidence": "medium"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 162,
            "snippet": "You can see why WPForms is the best WordPress contact form plugin on the market! Want to unlock these features? [Upgrade to our Pro version](https://wpforms.com/?utm_source=wprepo&utm_medium=link&utm_",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 541,
            "snippet": "- IMPORTANT: Support for PHP 7.1 has been discontinued. If you are running PHP 7.1, you MUST upgrade PHP before installing WPForms 1.9.5. Failure to do that will disable WPForms core functionality.",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 599,
            "snippet": "- IMPORTANT: Support for PHP 7.0 has been discontinued. If you are running PHP 7.0, you MUST upgrade PHP before installing WPForms 1.9.3. Failure to do that will disable WPForms core functionality.",
            "confidence": "low"
        },
        {
            "pattern": "Upgrade",
            "kind": "ioc:changelog_phrase",
            "file": "readme.txt",
            "line": 821,
            "snippet": "- Fixed: Upgrade to the Pro link had wrong styling on Bluehost hosted sites.",
            "confidence": "low"
        }
    ],
    "triage_note_2026_05_03": "wpforms-lite: base64_decode + eval matches in vendored ezyang/htmlpurifier library + Crypto helpers. WPForms is well-known form plugin."
}

{
    "slug": "wpforms-lite",
    "pattern": "unserialize_after_remote_call",
    "kind": "builtin",
    "version": "1.10.0.4",
    "hit_count": 3,
    "first_hit": {
        "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php",
        "line": 71,
        "snippet": "L71: return \\unserialize(\\file_get_contents($file));  \u2192  L71: return \\unserialize(\\file_get_contents($file));"
    },
    "explanation": "a remote HTTP fetch (`wp_remote_*`/`curl_exec`) is followed by `unserialize`/`maybe_unserialize` within the same file \u2014 classic PHP Object Injection C2 gadget used by EP and most WP supply-chain backdoors. Legit plugins essentially never do this."
}

{
    "slug": "wpforms-lite",
    "previous_version": "1.10.0.4",
    "current_version": "1.10.0.4",
    "new_findings": [
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/DefinitionCache/Serializer.php",
            "line": 71,
            "snippet": "L71: return \\unserialize(\\file_get_contents($file));  \u2192  L71: return \\unserialize(\\file_get_contents($file));",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/ConfigSchema.php",
            "line": 69,
            "snippet": "L68: $contents = \\file_get_contents(\\WPForms\\Vendor\\HTMLPURIFIER_PREFIX . '/HTMLPurifie  \u2192  L69: $r = \\unserialize($contents);",
            "confidence": "high"
        },
        {
            "pattern": "unserialize_after_remote_call",
            "kind": "builtin",
            "file": "vendor_prefixed/ezyang/htmlpurifier/library/HTMLPurifier/EntityLookup.php",
            "line": 27,
            "snippet": "L27: $this->table = \\unserialize(\\file_get_contents($file));  \u2192  L27: $this->table = \\unserialize(\\file_get_contents($file));",
            "confidence": "high"
        }
    ],
    "new_finding_count": 3
}