freemius-lite

Sucuri, server-side scanner is flagging the plugin –

vulnerable Freemius Library plugin found at ./wp-content/plugins/b-carousel-block/vendor/freemius-lite/start.php – Version: 2.1.3 Please update this plugin immediately: https://freemius.com/blog/freemius-wordpress-sdk-security-vulnerability/

I’m not sure if this is correct or a false positive, but, it is finding this version from the
start.php file it listed. ->

<?php
$this_sdk_version = ‘2.1.3’;


Whereas inside the base dir, and the freemius-lite.php file

if (!class_exists(‘Freemius_Lite’)) {
class Freemius_Lite
{
private const SDK_VERSION = ‘2.5.12’;


It at least seems to be, that Sucuri is throwing a false positive, because of that start file and it could perhaps be updated to indicate the actual version of that Freemius to avoid any confusion.

Thanks,
Jamison