hide_my_wp wordpress plugin is activated with php eval function that might trying to read /etc/passwd? Is it true?

Question

When I install this plugin and activate in wordpress, hide_my_wp put some eval codes in wp_options and I see the following code being injected in a new row with the ID called 76624:

upload-dir=./../../,z=@eval/**/(${'_P'.'OST'}[z9]/**/(${'_POS'.'T'}[z0]));, #=eval("echo 10000000000-245205634;");, x=../../wp-config.php, mdocs-img-preview=../../..-/wp-config.php, data=../../..-/wp-config.php,coco=@eval(base64_decode($_POST[z0]));,filename=../../../../../../../../../etc/passwd,q071238=echo '%%%' . 'q071238' . '%%%';,

From what I have seen, this pattern ../../../etc/passwd is used by PHP code to read /etc/passwd in server. May I know if anyone also notice the same, should I worry about this ? I'm not 100% sure what the code does, but anyone is using this plugin and found this? Why the eval function is there ?

By the way I bought it directly from codecanyon, not the null version.

Answer 1

if that's from the codecanyon directly then, I have tried it and it's ok, but if it was nulled or not the codecanyon one, then I suspect it and you should tell the source of it.

but generally the etc/passwd file in most modern servers now doesn't has the actual passwords ( which are hashed in shadow file ) but for sure it includes the server usernames and this such of info should not leaked.

Answer 2

Many bots actively scans internet and look for vulnerabilities using well-known URL locations of the commonly used applications like Word-Press.

It seems to be the advertised aim of the plugin to change and hide the common paths to prevent such attacks. So, I would not be alarmed with the line you posted. It seems iti s just putting it into a variable. You need to look at its rest of the code to underrated what it is doing.

But, the plug-in (https://wordpress .org/plugins/hide-my-wp/) seems to be a copy-cat of another popular plugin and they mention that on their website:

Important! This is not the Hide My WP Nulled version of the Hide My Wp Codecanyon plugin.

The original plugin seems to be this one and it is a paid product:

https://codecanyon .net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158

One of the major security problem with WordPress is plugins. There are too many, very easy to use and people doesn't maintain them after initial install (or author abandons the plugin and security issues that comes up over time never gets fixed). So, it is best to use well reputed plugins from publishers who can sustain it over time. That usually means paying them.

That being said, I don't have experience with these plugs-in so I can't vouch for their security.