False positive in the NextScripts SNAP plugin.

I have installed your plugin on three of my test sites and scanned that file and your whole plugin against my current definitions and I cannot get it to come up as any kind of threat. Are you sure that the file you have has not been altered?

Can you please send me the file you have so I can check it?

Also, what threat does it say if found (hover over the numbered link “[1]” to see the threat name)?

Thanks for all that extra info. I was able to replicate this false positive on a server with PHP v5.6, it would seem that there is a difference in Regex interpretation in different versions of PHP. I am isolating the factors that contributed to this false identification now and I will release a new definition ASAP to fix this…

Just FYI, I can see that what you are doing in this file is not malicious, but the reason that it was such a close match was that you are using a Variable Function (i.e. $fnName($postID, $nto);) where $postID is set to a _POST variable (i.e. $postID = $_POST[‘id’];).

The combination of variable functions and posted values can be extremely dangerous and is frequently used by hackers to exploit WordPress sites, but I can tell that your code is not a threat and you are using this combo in a safe and responsible way. I am sorry for mislabeling your plugin as a threat and I appreciate you working with me to correct this issue (it’s hard to find all the bad guys and not occasionally point the finger in the wrong direction ;- )