Flag by Wordfence Security Plugin

  • Resolved Web Whales

    (@webwhales)


    1 week, 4 days ago

    Dear Support,

    I’ve noticed that a report came in from Wordfence about possible malicious code within the Robin plugin. It was about the following notice:

    Suspicious ROT13-encoded filter associated with rogue WP plugins

    This is located within the file: /wp-content/plugins/plugins/robin-image-optimizer/includes/classes/class-rio-media-library.php.

    Specifically it is about the following piece of code:

    add_filter(str_rot13('jope/evb/nyybj_freiref'), 'WIO_Backup::alternateStorage');

    Wordfence is in my opinion rightfully flagging this since functions like: str_rot13 could be used by hackers to mask certain strings in the code.

    My primary question is, why is this needed? Why can’t we just have the value here that str_rot13 is referring to? Which is wbcr/rio/allow_servers.

    I hope to hear from you guys regarding why this has been done and if there is any incentive from you guys to change this mechanism.

    Kind regards,

    • This topic was modified 1 week, 4 days ago by Web Whales.
Viewing 1 replies (of 1 total)
  • Plugin Support Kush

    (@kushnamdev)

    1 week, 3 days ago

    Hi @webwhales,

    Thanks for the detailed report and for taking the time to decode the string before reaching out.

    You’re correct that Wordfence flagged the pattern, but we can confirm this is a false positive. The code is part of the official plugin release from WordPress.org, and your site has not been compromised.

    The str_rot13() call is an old leftover from a previous implementation The logic it belonged to was removed some releases ago; this one registration was missed and has been carried along since. It registers the wbcr/rio/allow_servers filter, but the callback it points to no longer performs any logic, so it has no effect on the plugin’s behavior.

    We agree that this kind of code can look suspicious, so we’ve already removed it. The change will be included in an upcoming release. This will not affect functionality.

    We also reviewed the rest of the plugin and confirmed this is the only use of str_rot13(). There is no use of eval, base64_decode, gzinflate, create_function, or any other form of dynamic code execution in the plugin.

    For now, it’s safe to exclude this file from Wordfence scans. Once you update to the upcoming version, you can remove the exclusion.

    Thanks again for reporting this.

Viewing 1 replies (of 1 total)

You must be logged in to reply to this topic.