base64

[firebird]

I'm curious.

I ran an exploit scanner today and I noticed a base64 code showing up in the file datafeedr.php on line 1095.

The exact path to the file is wp-content/plugins/datafeedr/datafeedr.php

The scenario:

Returning customer
WP 3.0.5 installed
Installed ver3 plugin Feb 18, 2011

The suspicious code:

$buf = base64_decode(implode('', $buf));

Google has notified me that the site may be contain malicious scripts.

Is the base64_decode suppose to be there?

[Eric]

Hi

Yes, this code is supposed to be in there. It's part of the update process.

Here's more information about that function:
http://php.net/manual/en/function.base64-decode.php

Eric

[firebird]

Thanks Eric..