WP Manifestindependent plugin directory
manifest / utilities / wp-cryptoloot

WP CryptoLOOT WP RegistryCritical findings · 2 findingsOpen the reportF

A lightweight plugin that integrates CryptoLOOT miner and captcha with any WordPress installation.

by Scott Webber · github.com/scowebb/wp-cryptoloot · website

★ 5stars
2.1latest · 5 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/scowebb/wp-cryptoloot/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/scowebb/wp-cryptoloot ↗

WP CryptoLOOT

WP CryptoLOOT

What is WP CryptoLOOT?

WP CryptoLOOT is a free, lightweight plugin that will seamlessly connect CryptoLOOT to any WordPress installation, enabling options for captcha form protections and browser based crypto mining on the uPlexa blockchain.

Features

  • Set a fully customizable uPlexa (UPX) coin miner to run under the hood while visitors browse your site as an alternative to ad based revenue. If you choose to use this option then YOU MUST NOTIFY YOUR USERS.

  • Secure comments, login, and registration forms from brute force and SPAM attacks.

  • Use the shortcode [cryptoloot_gui] on any page or post to implement a GUI miner, allowing users to earn access to features such as premium content. Add the option autorun=true to start the miner on page load (see example here), and specify starting threads with threads=2.

    Demos

  • GUI Miner

  • Login

  • Registration

  • Comments

Getting Started

  • Step One: Sign up for an account with CryptoLOOT
  • Step Two: Install and activate the plugin on a WordPress website, then enter your public CryptoLOOT api key into the key field
  • Step Three: Choose your options and start mining UPX coin today!

Built With

  • CryptoLOOT - Browser based crypto-mining on the uPlexa blockchain
  • PHP - Hypertext Preprocessor
  • WordPress - Content Management System

Version

  • v2.1 - Bug fixes, code clean up (on Feb 12, 2021)
  • v2.0 - Added front-end GUI miner shortcode with an auto-start option (on Feb 8, 2021)
  • v1.2 - Added admin notices, increased max thread count to 100 (on Feb 5, 2021)
  • v1.1 - Fixed undefined index errors (on Jan 24, 2021)
  • v1.0 - Initial public release (on Sep 7, 2020)

License

This project is licensed under the GNU GPLv2 - see the LICENSE file for details

Disclaimer

This project has not been endorsed by the developers of CryptoLOOT, WordPress, or uPlexa.

Releases

5 releases.

Tag
Published
2.1 latest
Feb 12, 2021 5 years ago
2.0
Feb 12, 2021 5 years ago
1.2
Feb 5, 2021 5 years ago
1.1
Jan 24, 2021 5 years ago
1.0
Sep 7, 2020 6 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

F grade

Security

WP CryptoLOOT 2.1 · audited by WP Registry

Critical findings.

1 critical 1 high
Audited release
2.1
Findings
2
Worst severity
critical
Content hash
17cc15b33cc0f31ad21e40fe…

Findings

  • critical Client-side cryptocurrency miner loaded for site visitors

    malware_cryptominer

    When wpcl_auto_miner is enabled, cryptoloot_miner_payload hooks wp_head for logged-out non-mobile visitors and injects //statdynamic.com/lib/crypta.js plus CRLT.Anonymous miner with optional miner.start(). This uses visitors' CPU for mining to the site's CryptoLOOT public key (or a hardcoded developer key). Treat as malware_cryptominer / flagged for removal.

    wpcryptoloot.php:111-149

    Recommendation

    Remove the plugin. Do not enable auto miner. Prefer legitimate CAPTCHA providers without mining.

  • high Hardcoded developer CryptoLOOT public key fallback

    hardcoded_credentials

    Multiple captcha/miner paths fall back to hardcoded public key 7b98820d4d9738e5cd928e923f30e6a3c23ef47d57d9 when settings empty — mining/captcha proceeds to a third-party account.

    wpcryptoloot.php:152-220

    Recommendation

    Fail closed when no key configured; remove hardcoded key.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →