Table of Contents
- Are the Premium GPL Plugins Sold for $5 Safe for WordPress?
- Why GPL Premium Plugins Sold Cheap are Unsafe?
- What Kind of Security Issue does a Premium GPL WordPress Plugin Cause?
- What is the Alternate to a Premium GPL Plugin Not Sold by the Developer?
- How are these sites selling premium plugins for 5$ or cheaper than developers?
- What is an RMS Script MU Plugin?
While browsing the net you come across various websites named “GPL” with prefixes, they use powerful banners like ” Join the Club” for a monthly subscription and download any 12 plugins in a day for free.
Or Buy a single plugin for 5$ promising clean and original codes, the same functionality, and no need to enter the license keys.
Even I Came across a few listings on Fiverr, selling these nulled plugins, while Fiverr shouldn’t allow these listings being a marketplace for a user’s security concerns I wonder why they are allowing such stuff.
Are the Premium GPL Plugins Sold for $5 Safe for WordPress?
The Answer in No, They are not safe.
Why GPL Premium Plugins Sold Cheap are Unsafe?
GPL Premium Plugins sold are code manipulated. They simply stop the WordPress Developer’s original update and push their updates after changing the code.
You will see a notice on the products page,
the update arrives 2-3 days after the original update date,
In the meantime, the code gets manipulated by the plugin-selling site.
It’s then pushed to you by updates from controlled API from their servers, not from the developer’s API.
While we consider the safety of a WordPress website, a nulled, or cracked version of a plugin could ruin the entire site could also spoil the user experience.
These plugins without any Developer’s help or support on a Live Environment of your running site, would be a wrong decision.
Especially when it comes to Woo-Commerce or a shopping website, these should be strictly not used. As the data is sensitive, it can also relate to payments made by the users.
What Kind of Security Issue does a Premium GPL WordPress Plugin Cause?
A GPL Plugin could run malicious code, a script, or a database query that could fetch the user’s data and send it back to the servers of the hackers in the desired format.
These scripts could run in the background without the user being aware of the same, A “MU” ( Must Use ) plugin,
WITH a PHP RMS Script, anything is possible.
Must-use plugins or mu-plugins are plugins installed the directory inside the content plugins folder of the WordPress directory like /wp-content/mu-plugins/
As per the Title ” Must Use ” they have the following effects,
They are automatically enabled on all sites if you use a multisite network WordPress.
Must-use (MU) plugins show up in the list next to the default list of plugins on the Plugins.
They appear in a separate “Must-Use” section – and you can’t remove them from WordPress Admin Panel.
To remove, go to your /wp-content/mu-plugins directory using FTP Client, and you have to delete the file manually.
What is the Alternate to a Premium GPL Plugin Not Sold by the Developer?
No Alternative, you should always buy from the original developer with a unique license key or use the WordPress repository at wordpress.org.
For example, the Yoast SEO free and premium has just some fundamental differences like redirection that could be done with another free plugin quickly,
Keywords that you could add with the premium version, and some on-page analysis that you could also do with some external tools of SEO like chrome extensions.
Even if you buy the premium version, it won’t give you the morphology function of the premium Yoast SEO so practically it’s of no use.
The best would be to use the free Yoast or a plugin like Rank Math for your SEO.
How are these sites selling premium plugins for 5$ or cheaper than developers?
The sites are just taking advantage of the fact that WordPress is under GPL (General Public License), and anything made for WordPress is GPL itself.
What is an RMS Script MU Plugin?
RMS Script MU Plugins are malicious scripts added in the plugin’s PHP code to take a backdoor function to the core of the
site.
Here is one of my posts I have explained how to optimize your WordPress database for free please check this out too!
Backdoor Functionality, Role Creation, and Unwanted Advertisements are some of the correct topics in a similar context as explained in detail by Krasimir Konov who is a Sucuri’s Malware Analyst since 2014 in his recent blog post here Fake WordPress Plugin SiteSpeed Serves Malicious Ads & Backdoors.
