HTTP-Header-Gated PHP Loader Found in a Plugin File

Summary

This entry examines a one-line PHP loader observed at the beginning of a plugin file named buddyboss_legacy.php. The supplied code reads all request headers, checks for X-Dns-Prefetch-Control, and then uses values from three headers in nested dynamic callable operations.

The code structure supports classifying the line as a header-gated loader. The retained evidence does not include a triggering request, so this page does not claim that a particular payload executed. It also does not identify a vulnerable WordPress component or explain how the line was inserted.

Investigation context

The screenshot was retained during one anonymized WordPress investigation. It shows the injected line above code that otherwise identifies itself as a BuddyBoss legacy icon-picker file. A malicious line inside a plugin path does not, by itself, show that the plugin was the original access point.

For broad methods to review unreadable or dynamically invoked PHP, see how to recognize obfuscated PHP malware in WordPress. This research page focuses only on the distinctive header names and callable structure in the supplied artifact.

Observed artifact

The suspicious line appears immediately after the opening PHP tag and before the file’s normal documentation block. It is visually separate from the surrounding implementation and uses a compact variable name, getallheaders(), a conditional header check, nested calls, and a final invocation of the returned value.

Confirmed findings

• A PHP line was present at the top of the observed buddyboss_legacy.php file.
• The line calls getallheaders() and checks for X-Dns-Prefetch-Control.
• It references If-Unmodified-Since and Feature-Policy from the same header collection.
• Values from the headers are used in nested dynamic calls.
• The value returned by the outer call is invoked again as a callable.

Technical analysis of the header-gated loader

The three header names are legitimate HTTP concepts, but this PHP file does not use them for their normal web semantics. Instead, their values participate in callable selection and input transformation. That combined structure is the useful detection pivot.

Dynamic callable flow

Redacted defensive excerpt

headers = read_request_headers()

if a distinctive control header exists:
    transformed_value = call_function_named_by_header(
        empty_argument,
        call_second_function_named_by_header(third_header_value)
    )
    invoke(transformed_value)

This pseudocode deliberately omits an operational request format, header values, and a runnable PHP implementation. It describes only the control flow needed for defensive recognition.

Why the local file matters

The earlier draft described execution without local traces. The screenshot contradicts that wording: the one-line loader is visibly stored in a local PHP file. A later payload might be supplied at request time, but the gating logic itself is a persistent file modification that can be found through integrity comparison or code search.

Analyst assessment

This is consistent with a request-gated backdoor loader because untrusted header values determine callable operations and a returned callable is invoked. One plausible use would be to supply a decoder and a function-producing value through the headers. The repository does not retain the request needed to confirm that runtime sequence, so it remains analyst assessment rather than an observed execution claim.

Indicators of compromise

Higher-confidence indicators

• The combined header-name set X-Dns-Prefetch-Control, If-Unmodified-Since, and Feature-Policy inside PHP application code
• getallheaders() followed by nested dynamic callable use and a final invocation
• A compact injected line appearing before the legitimate body of a plugin file

Contextual indicators

• buddyboss_legacy.php
• getallheaders()
• A PHP statement placed directly after an opening tag

The filename and getallheaders() are not malicious by themselves. Investigators should compare the file with a trusted copy and search for the full structural combination.

What this evidence does not establish

• No triggering HTTP request was retained.
• The screenshot does not prove that the line executed.
• The specific runtime callables and payload were not observed.
• The initial compromise method was not confirmed.
• No plugin vulnerability or affected version was identified.
• The evidence does not establish campaign attribution, prevalence, or effects beyond this artifact.

Artifact-specific remediation

Preserve the affected file and relevant access logs before replacement when investigation history matters. Replace the modified plugin component with a verified clean copy from its trusted source rather than editing only the one line. Search PHP files for the three-header combination and for the same nested callable shape.

Review recently modified plugins, themes, must-use plugins, administrator accounts, scheduled tasks, and server access. Rotate credentials relevant to the confirmed compromise scope. For the complete response process, use the broader hidden backdoor investigation guide or the WordPress malware removal guide.

Recurrence verification

• Compare the restored plugin directory with a trusted distribution.
• Repeat the structural code search after normal traffic and scheduled tasks.
• Review access logs for requests carrying the distinctive three-header combination, where logs retain header data.
• Confirm that the injected line does not reappear after cache clears, deployments, or administrator actions.

Related malware research

• wp-config.php XOR temporary-file loader
• SavvyWolf MANAGER PHP web-shell variant
• PHP footer remote-content loader

Methodology and privacy note

This analysis uses one privacy-reviewed screenshot and the supplied line of PHP from an anonymized client investigation. The public excerpt is non-operational and does not reproduce a working request. Findings labeled confirmed are visible in that evidence; runtime behavior without a retained request is explicitly limited to analyst assessment.