MalDet · Static Security Report
This repository has a high vulnerability score of 86.0, which means that an attacker could easily exploit insecure coding patterns to break into your system or steal data. While the code does not appear to be intentionally malicious, it contains several dangerous practices like direct access to untrusted input without proper escaping and the use of unserialize() with user data, which are common mistakes rather than signs of a hidden attack. The scan also found some supply-chain risks related to GitHub Actions and loose version constraints that could potentially introduce new vulnerabilities if not fixed. Overall, while the code isn't clearly designed to harm you, it is unsafe as-is because these issues can be easily exploited by someone with basic knowledge of how PHP works.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| semgrep | Insecure coding patterns across many languages | 0 | 41 | 0 | 41 |
| yara | Signatures of malicious behaviour in source files | 0 | 0 | 1 | 1 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 1 | 1 |
40 of 43 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| medium | semgrep | Found direct access to a PHP variable wihout HTML escaping inside an inline PHP statement setting data from `$_REQUEST[...]`. When untrusted input can be used to tamper with a web page rendering, it can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted inpu | 16 | /templates/frontend/subscriptions.php:399 |
| medium | semgrep | User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources th | 3 | /includes/class-admin.php:1195 |
| medium | semgrep | GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: ac | 21 | /.github/workflows/test.yml:84 |
| medium | semgrep | Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). | 1 | /includes/class-admin.php:2402 |
| low | dep_checker | Loose version constraint: 'lerna^6.1.0' — attacker could push malicious update | 1 | package.json |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 1 | /bin/install-wp-tests.sh |