=== SW87 Security Scanner ===
Contributors: SW87
Tags: security, scanner, malware, wordpress security, plugin detector, backdoor scanner, vulnerability scanner
Requires at least: 5.0
Tested up to: 6.5
Stable tag: 3.8
Requires PHP: 7.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Comprehensive security scanner that detects compromised Essential Plugin portfolio plugins, scans for backdoors, suspicious admin accounts, and finds where plugins are used across your entire WordPress installation.

== Description ==

**SW87 Security Scanner** is a complete security tool that helps you identify and remove compromised plugins from the April 2026 supply chain attack, as well as detect other security threats.

### What This Scanner Does

* **Detects 31+ compromised Essential Plugin plugins** (WP Featured Content and Slider, Countdown Timer Ultimate, Popup Anything on Click, WP Responsive Recent Post Slider, and many more)
* **Shows you WHERE each plugin is used** - finds shortcodes in pages, posts, widgets, Customizer settings, and theme files
* **Scans database options** - finds shortcodes hidden in theme mods and Customizer sections
* **Scans theme files** - finds hardcoded plugin references in PHP files
* **Scans WordPress core files** - detects malware in wp-admin and wp-includes
* **Detects backdoor files** - finds known hacker backdoors (object-cache-helper.php, class-wp-locale-helper.php, etc.)
* **Detects suspicious admin accounts** - finds hacker-created accounts (wpsvc_*, wp_maint_* patterns)
* **Shows available updates** - WordPress core, plugin, theme, and translation updates with security priority indicators

### How It Finds Plugin Usage

The scanner searches for Essential Plugin shortcodes and patterns in:

| Location | What It Finds |
|----------|---------------|
| **Pages & Posts** | Shortcodes like `[recent_post_carousel]`, `[featured-content-slider]`, `[countdown_timer]` |
| **Customizer Settings** | Shortcodes in theme mods, section descriptions, and other Customizer fields |
| **Widgets** | Widget areas using compromised plugins |
| **Theme Files** | Hardcoded shortcodes in header.php, footer.php, functions.php, etc. |
| **WordPress Core** | Unusual plugin references in core files (indicates serious compromise) |

### Why You Need This Scanner

In April 2026, a malicious actor purchased the entire Essential Plugin portfolio (31+ plugins) and inserted backdoors. These plugins were trusted by hundreds of thousands of websites. The backdoor allows hackers to:

* Execute remote code on your server
* Create hidden admin accounts
* Inject spam and malware into your site
* Steal sensitive data

Wordfence and other security plugins can detect the malware files, but they don't tell you **where** the plugin is being used. This scanner fills that gap - it shows you exactly which pages, posts, Customizer sections, and theme files contain the compromised plugin's shortcodes so you can replace them before deleting the plugin.

### Complete List of Detected Plugins

The scanner detects the following compromised plugins (by folder name and author):

* WP Responsive Recent Post Slider
* WP Featured Content and Slider
* Countdown Timer Ultimate
* Popup Anything on Click
* Post Grid and Filter Ultimate
* WP Logo Showcase Responsive Slider and Carousel
* WP Team Showcase and Slider
* WP Testimonial with Widget
* Accordion and Accordion Slider
* Hero Banner Ultimate
* Ticker Ultimate
* Album and Image Gallery Plus Lightbox
* Audio Player with Playlist Ultimate
* Blog Designer for Post and Widget
* Featured Post Creative
* Footer Mega Grid Columns
* HTML5 VideoGallery Plus Player
* Meta Slider and Carousel with Lightbox
* Portfolio and Projects
* Post Category Image with Grid and Slider
* Preloader for Website
* Product Categories Designs for WooCommerce
* Responsive WP FAQ with Category
* SlidersPack – All in One Image Sliders
* SP News And Widget
* Styles for WP PageNavi
* Timeline and History Slider
* Woo Product Slider and Carousel with Category
* WP Blog and Widgets
* WP Slick Slider and Image Carousel
* WP Trending Post Slider and Widget

### Also Detects

* **Smart Slider 3 Pro** version 3.5.1.35 (malicious version)
* **Burst Statistics** versions below 3.4.2 (CVE-2026-8181 authentication bypass)
* **Kirki Customizer Framework** versions 6.0.0-6.0.6 (CVE-2026-8206 privilege escalation)

== Installation ==

1. Upload the `sw87-security-scanner` folder to the `/wp-content/plugins/` directory
2. Activate the plugin through the 'Plugins' menu in WordPress
3. Go to **SW87 Scanner** in your WordPress admin menu
4. Click **Run New Scan** to check your site

For quick security checks, look at the dashboard widget that appears on your main WordPress dashboard.

== Frequently Asked Questions ==

= How is this different from Wordfence? =

Wordfence detects malware files but doesn't show you where the plugin is being used. This scanner shows you exactly which pages, posts, Customizer sections, and theme files contain the compromised plugin's shortcodes - so you know what needs to be rebuilt before you delete the plugin.

= Why do I need to find where the plugin is used? =

If you simply delete a compromised plugin without knowing where it was used, you will break your site. The "Find Usage" feature shows you every location where the plugin's shortcodes appear, so you can replace them with safe alternatives first.

= What does the "Full Scan" button do? =

The Full Scan checks:

1. **Posts & Pages** - searches for shortcodes in all content (published, draft, private)
2. **Database Options** - searches Customizer settings, theme mods, and widget settings
3. **Theme Files** - scans all PHP files in your theme directory
4. **WordPress Core** - scans wp-admin and wp-includes for unusual references

= The scan is taking a long time. Is this normal? =

Yes, especially the first time you run it. Scanning theme files and database options can take 10-30 seconds depending on your theme size and number of database options. Progress bars show you what the scanner is doing.

= My scanner says no issues found, but Wordfence shows malware. Why? =

Make sure you have run the **Full Scan** (not just the initial scan). Click the "Full Scan" button next to the detected plugin to search for usage.

Also, ensure your plugin is active. The scanner only shows critical issues for active plugins. If the plugin is inactive, it will show as a warning.

= Can this scanner fix the issues automatically? =

No. This scanner only **reports** issues and shows you where plugins are used. You must manually remove shortcodes from your content, Customizer settings, and theme files, then delete the compromised plugins. This is intentional - automatic removal could break your site.

= Does this plugin work on multisite? =

Yes. The scanner checks network-activated plugins as well as site-activated plugins.

= Will this plugin slow down my site? =

No. Full scans only run when you manually trigger them or every 6 hours via cron. The dashboard widget shows cached results and does not slow down your site.

== Screenshots ==

1. Dashboard widget showing security status at a glance
2. Full scan report with critical issues and usage locations
3. Database options scanner finding shortcodes in Customizer settings
4. Theme file scanner showing hardcoded plugin references
5. Available updates section with security priority indicators

== Changelog ==

= 3.8 =
* Added database options scanner - finds shortcodes in Customizer settings (theme mods)
* Added detection for [recent_post_carousel] and other Essential Plugin shortcodes
* Improved theme file scanning with better pattern matching
* Added progress indicator for all scan steps

= 3.7 =
* Added generic detection for ALL Essential Plugin patterns (wpos_, wps_, etc.)
* Fixed detection for WP Responsive Recent Post Slider
* Added multisite network-activated plugin support
* Improved author-based detection

= 3.6 =
* Fixed detection for inactive plugins (still shown as warnings)
* Added support for plugin folder name variations

= 3.5 =
* Added scanning for draft, private, scheduled, and pending posts
* Added WordPress core file scanning (wp-admin, wp-includes)
* Added status badges for different post statuses

= 3.4 =
* Added progress bar for theme file scanning
* Added real-time file count display

= 3.3 =
* Added "Find Where Used" button with Ajax scanning
* Shows direct edit links to pages/posts using the plugin
* Shows theme file references with line numbers and code snippets

= 3.2 =
* Added deep theme file scanning
* Shows exact file path, line number, and code snippet

= 3.1 =
* Added dashboard widget
* Cached results for performance

= 3.0 =
* Initial release with basic plugin detection and security checks

== Upgrade Notice ==

= 3.8 =
Critical update! Now scans Customizer settings where shortcodes may be hidden. Run a new full scan after updating.

= 3.7 =
Important update for sites with WP Responsive Recent Post Slider or other Essential Plugin plugins. Now detects by author and folder name.

= 3.6 =
Update recommended for all users. Fixes detection for inactive plugins.

== Additional Information ==

### Known Shortcode Patterns Detected

The scanner searches for these Essential Plugin patterns:

* `[recent_post_carousel]` - WP Responsive Recent Post Slider
* `[recent_post_slider]` - WP Responsive Recent Post Slider
* `[featured-content-slider]` - WP Featured Content and Slider
* `[fc_slider]` - WP Featured Content and Slider
* `[countdown_timer]` - Countdown Timer Ultimate
* `[ct_ultimate]` - Countdown Timer Ultimate
* `[popup_anything]` - Popup Anything on Click
* `[paoc_popup]` - Popup Anything on Click
* `[post_grid_filter]` - Post Grid and Filter Ultimate
* `[pgaf]` - Post Grid and Filter Ultimate
* `[logo_showcase]` - WP Logo Showcase
* `[team_showcase]` - WP Team Showcase and Slider
* `[testimonial_slider]` - WP Testimonial with Widget
* `[accordion_slider]` - Accordion and Accordion Slider
* `[hero_banner]` - Hero Banner Ultimate
* `[news_ticker]` - Ticker Ultimate

Plus generic patterns: `wpos_`, `wps_`, `wpc_`, `pgaf_`, `paoc_`, `ct_ultimate_`

### What to Do When a Plugin is Found

1. Click **"Full Scan"** next to the plugin
2. Review all locations where the plugin is used (pages, posts, Customizer, theme files)
3. For each page/post, edit and replace the shortcode with a safe alternative
4. For Customizer settings, open Appearance → Customize and remove/replace shortcodes
5. For theme files, edit via FTP and remove plugin references
6. After all references are removed, delete the compromised plugin via WordPress admin

### Support

For questions or support, please contact your website developer or hosting provider.

---

**Disclaimer:** This plugin is provided as-is. Always backup your site before making changes. The author is not responsible for any data loss or site damage that may occur from using this plugin.