[Plugin: JR Protection] Plugin Injects SEO spam links in wp_footer

This plugin has an option ( “Show Plugin Support?” ) that is enabled by default. With this option enabled, the plugin injects a support link in the footer, using wp_footer.

That’s all well and good, except that this link determined by the following code (Lines 102-128):

if (_iscurlinstalled()) {
$pname="jr_protection";
$url=get_bloginfo('url');
$content = curl_get_contents("http://www.jakeruston.co.uk/plugins/links.php?url=".$url."&pname=".$pname);
update_option("jr_submitted_protection", "1");
wp_schedule_single_event(time()+172800, 'jr_protection_refresh');
} else {
$content = "Powered by <a href='http://arcade.xeromi.com'>Free Online Games</a> and <a href='http://directory.xeromi.com'>General Web Directory</a>.";
}

if ($content!="") {
$content=utf8_encode($content);
update_option("jr_protection_links_choice", $content);
}
}

if (get_option("jr_protection_link_personal")=="") {
$rand=rand(2,2);

switch ($rand) {
case 1:
$anch="Jake Ruston's <a href='http://www.jakeruston.co.uk'>Wordpress Plugins</a>";
break;
case 2:
$anch="<a href='http://www.xeromi.net'>Cheap Web Hosting</a>";
break;
}

So basically, the plugin is pulling in the support links from the developer’s website (meaning the user has no control over them or even any foreknowledge of what they will be) – or else a couple of hard-coded, super-spammy links are used randomly in rotation with the one, legitimate support link.

Just have a look at what is currently being pulled in by http://www.jakeruston.co.uk/plugins/links.php

Further, the plugin adds an iframe to the admin options page – once again, pulling in more spammy advertising. But again, the user has no control over or foreknowledge of the content of the URL targeted by the iframe (huge potential security problem).

And again: have a look at what is currently being loaded by that iframe: http://www.jakeruston.co.uk/plugins/index.php

All of the above are in violation of the terms of service for hosting a plugin in the wordpress.org repository.

http://wordpress.org/extend/plugins/jr-protection/