niletech: nulled Fluent Forms Pro and Ninja Tables Pro (OYLITE / oykit.com)

FeatureOpenView on roadmap· 13 days ago

Imported from GitHub issue El-SaMa/oma#204 by @El-SaMa.

Found 2026-10-14 while working on #197.

wp-content/plugins/fluentformpro (6.1.21) and ninja-tables-pro (5.2.3) on niletech.fi are nulled copies from oykit.com ("OYLITE"). They intercept the licence server with a pre_http_request filter and write a fake "valid, lifetime" licence (_ff_fluentform_pro_license_*, customer OYLITE, payment_id 12345) on every request. README.url in the plugin folder points to https://oykit.com/oylite.

Why it matters:

No official updates: Fluent Forms Pro has a critical CVE (CVSS 9.8, fixed in 6.2.8) plus several highs. Arx flags them but cannot update premium plugins.
Nulled packages are a common backdoor vector. A quick pattern scan found nothing obvious (the base64 hits are normal plugin code), but that is not a full audit.
The fake licence write is one of the per-request option rewrites from #197.

Decision for the operator: buy genuine licences and install the official packages (Arx then keeps them updated), or remove the plugins if their features are not needed.

Comments (0)

No comments yet.

Join the discussion