Is AR Wp Detector - Best Instant Wordpress Theme Plugin Detector safe?

Medium risk

AR Wp Detector reads your signed-in Chrome profile email and sends it to api.wpoptic.com on startup.

On startup and after each version change, the extension reads the email of the signed-in Chrome profile and posts it with the extension ID to api.wpoptic.com. On every page it also checks whether the site runs WordPress, and for WordPress pages it sends the full page URL plus detected plugins and theme to the same server. No consent prompt precedes either transmission.

Ariyan Islam Raj v1.0Chrome Web Store
49Risk
Who publishes it

Ariyan Islam Raj - no other listings under this identity, 1 shared hostname

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Ariyan Islam Raj
Declared legal entity
Ariyan Islam Raj
Website
ariyanislamraj.me/contact

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

api.wpoptic.com
Also called by 1 other listing: WPoptic | WordPress Theme Detector and Plugins Detector

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

WPOptic sends your Chrome profile email to its server at startup

Code analysis shows the extension reads the email of the signed-in Chrome profile and posts it with its extension ID to api.wpoptic.com at startup and after each version change.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Static analysis
What actually happens
You did this

You open Chrome with the extension installed and a Google account signed in.

The extension did this

The extension reads your profile email and sends it to api.wpoptic.com.

The request includes the extension ID and runs without a prompt in the code.

The code that does this

Email lookup and POST to the vendor endpoint

Readable version

Re-send gate: first run or version change

background.js
const data = await chrome.storage.local.get(['user_data_sent', 'last_version']);const currentVersion = CURRENT_VERSION;if (!data.user_data_sent || data.last_version !== currentVersion) {  await sendUserData();  await chrome.storage.local.set({ 'last_version': currentVersion });}
Fields in the POST body
  • Profile email
    jane.doe@example.com (illustrative)

    The email of the Google account signed in to Chrome.

  • Extension ID
    olhimaaodbadkinonmaidjecfakdbgol

    Identifies which install the email belongs to.

Destination of the data
    • api.wpoptic.com

    Receives the email and extension ID at /chrome-extension/user.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed AR Wp Detector - Best Instant Wordpress Theme Plugin Detector contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.wpoptic.com

    AR Wp Detector - Best Instant Wordpress Theme Plugin Detector sends data to api.wpoptic.com. 2 other extensions we have analysed send data here.

Updated 15 October 2026olhimaaodbadkinonmaidjecfakdbgol