Title: Cannot decrypt encrypted PHP code for Plug-in
Last modified: August 21, 2016

---

# Cannot decrypt encrypted PHP code for Plug-in

 *  [Chris](https://wordpress.org/support/users/mccarthyc/)
 * (@mccarthyc)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/)
 * First day ever using the WordPress.org forums, so please forgive me if this is
   in the wrong category.
 * I have the following code, which I need to modify for a plug-in:
 * _[code removed]_
 * But, as you can see, it is encrypted. I have tried several decrytion sites, but
   nothing worked. Please help.

Viewing 7 replies - 1 through 7 (of 7 total)

 *  [WPyogi](https://wordpress.org/support/users/wpyogi/)
 * (@wpyogi)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269317)
 * Where is that code from? You can’t post that much code on these forums – see:
   [http://codex.wordpress.org/Forum_Welcome#Posting_Code](http://codex.wordpress.org/Forum_Welcome#Posting_Code)
 * You need to use a pastebin for that much and that kind of code.
 *  Thread Starter [Chris](https://wordpress.org/support/users/mccarthyc/)
 * (@mccarthyc)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269328)
 * Oh ok sorry and thank you.
 * Here we go:
    [http://pastebin.com/b3iw2RWv](http://pastebin.com/b3iw2RWv)
 *  [catacaustic](https://wordpress.org/support/users/catacaustic/)
 * (@catacaustic)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269371)
 * I’d also ask (again) where the code is from? Most times any plugin/theme that
   uses encryption it’s because there’s some propriitary code that’s not GPL-licensed
   and they want to keep it “hidden”. BUT, I don’t think that’s the case here because
   what they’ve done doesn’t look liek encryption, just obfuscation where they’ve
   changed function and variable names to be nonsense. The aprt that would worry
   me with this is that there’s references to files, and that’s normally where something
   malicious comes into it. If it was me, I’d get rid of that code, and whatever
   plugin/theme/whatever it came in. Seeing something like that makes me 99.999%
   sure that something nasty is being attempted under the covers.
 *  Thread Starter [Chris](https://wordpress.org/support/users/mccarthyc/)
 * (@mccarthyc)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269445)
 * Really? It is from the plug-in called “WishList Member” which is a professional
   plug-in that I believe you have to purchase. We hired a consultant who suggested
   it and gave it to our company. I can’t imagine that it would be malicious.
 * But this scares me now lol..
 * Specifically, this code was from the “Shortcodes.php” file I found when viewing
   the WishList plug-in code edit area (Plugins > Editor > WishList Member).
 *  Moderator [bcworkz](https://wordpress.org/support/users/bcworkz/)
 * (@bcworkz)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269471)
 * In that case it is probably not malicious, but being proprietary code, it was
   obfuscated precisely to prevent what you are trying to do. Where proprietary 
   code is involved, there is not anything anyone here can help you with, we can
   only advise on open source code, sorry.
 *  [catacaustic](https://wordpress.org/support/users/catacaustic/)
 * (@catacaustic)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269483)
 * Got to agree with bcworkz there. If it’s in a “commercial” plugin the chances
   of it being malicious are less, so it’s not as great a concern as it could be.
 * The times that I’ve seen this before it’s been either tracking code that does
   call-backs to the companies servers, or it’s been to add in links that you don’t
   realise are there. Either way I don’t like having something like that on a site
   of mine. 🙂
 *  [catacaustic](https://wordpress.org/support/users/catacaustic/)
 * (@catacaustic)
 * [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269497)
 * After some playing around, I’ve been able to decrypt a bit of it. Most of what
   I got was helper code, but the main telling part was the first real line that
   I got back:
 * `class WishListMemberShortcode {`
 * Looking at that and the rest that I got (I didn’t get anywhere near the whole
   lot) it doesn’t look like it’s meant ot do anything bad. There’s still a chance
   as I didn’t go through the whole thing, but that possibility is pretty small.
 * The only question that’s left is just why the developer decided to go to that
   much trouble to “hide” their code? I guess they’re just a bit too paranoid about
   it getting stolen. Although, from what I’ve seen I think that it’s quicker to
   decrypt it then it would be to write it myself. 😉

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Cannot decrypt encrypted PHP code for Plug-in’ is closed to new replies.

## Tags

 * [code](https://wordpress.org/support/topic-tag/code/)
 * [decrypt](https://wordpress.org/support/topic-tag/decrypt/)
 * [encrypted](https://wordpress.org/support/topic-tag/encrypted/)
 * [php](https://wordpress.org/support/topic-tag/php/)

 * In: [Hacks](https://wordpress.org/support/forum/plugins-and-hacks/hacks/)
 * 7 replies
 * 4 participants
 * Last reply from: [catacaustic](https://wordpress.org/support/users/catacaustic/)
 * Last activity: [12 years, 6 months ago](https://wordpress.org/support/topic/cannot-decrypt-encrypted-php-code-for-plug-in/#post-4269497)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics