Banner Manager Pro WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC-

High-severity findings.

Audited release

3.4.0

Findings

1

Worst severity

high

Content hash

5c465478dbf0dd081016346b… Copy

Findings

• high Remote Worker PHP stored in bmp_premium_files is eval()'d on every licensed request

  eval_by_design

  After a successful license, bmp_download_premium() POSTs the license key to https://dp-starter.khalid.digital/premium and writes the JSON files object to option bmp_premium_files. bmp_load_premium_code() runs from the main plugin file on every request (front-end included) whenever bmp_is_licensed() is true: it re-downloads when transient bmp_premium_fresh is missing (daily, and on version change), AES-256-GCM-decrypts six named blobs with a key derived from the license key (str_pad(substr(strtoupper(str_replace('-','',$key)),0,32),32,'0')), and eval()s the plaintext. There is no public-key signature, hash allow-list, or on-disk reviewed file — AES-GCM only proves the Worker that knows the license key produced the ciphertext, and that Worker can change the PHP at the next refresh without a plugin update. The shipped zip is a stub; CPT registration, meta boxes, and the documented as-is HTML/JS banner/popup insertion all live in those blobs, so a compromised or malicious Worker is site RCE plus storefront skimmer. A second path from the same host: bmp_check_plugin_update() GETs /update-check?product=banner-manager-pro with no license check and copies data.download_url into the update_plugins transient package field (no zip hash). bmp_force_update_check on admin_init (no capability) can delete that transient once per hour, including from unauthenticated admin-ajax.php, accelerating the next fetch. This is vendor DRM rather than a hidden webshell, but it is persistent DB-stored PHP execution scanners will not see in wp-content/plugins.

  inc/license.php:288-362

  Recommendation

  Ship the CPT/meta/front-end PHP in the plugin zip (or extract a signed package onto disk and include those files). Do not eval() option-stored blobs. If remote delivery stays, verify an Ed25519/public-key signature over the plaintext, pin the Worker identity, and fail closed on mismatch. Stop injecting an unsigned download_url into update_plugins; at least require a sha256 of the zip. Gate bmp_force_update_check behind manage_options (or remove it).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.