WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine.

learn more… | top users | synonyms

1
vote
1answer
62 views

Wordpress blog hacked?

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some ...
0
votes
0answers
11 views

wordpress unknown IP was logged in [duplicate]

I am using wordfence on my wordpress website and enabled sending message when someone logged in to my site after checking my email An uknown IP address was logged in as admin user to my wordpress ...
1
vote
0answers
24 views

Security issues IIS 7.5 with PHP 5.3 [duplicate]

We are facing alot of weird php files all over our WordPress websites on our IIS 7.5 server. The file look like XSS script and maybe that php code that the hacker use to send spam emails or something ...
2
votes
3answers
69 views

Creating a website to test my scanner that I scripted

Hi I looked around on Google and this site for about the last hour and I couldn't find anything that gave a direct answer to my question. I changed the code around in a scanner that I used in the ...
3
votes
1answer
58 views

Content management url security

I manage a website that is a "bad magnet" for our competitors. I am using Incapsula CDN + WAF and I have internal proxy for caching. CMS/WP from its nature is very data consuming, I have check ...
1
vote
0answers
128 views

How to exploit CVE-2014-5203? [closed]

There is a vulnerability in WordPress 3.9 that allows an attacker to execute arbitrary PHP code (remote code execution) and the details about the same are covered in CVE-2014-5203: ...
1
vote
1answer
89 views

How to prevent adding malicious code, found in hacked Wordpress website?

I have a website created using Wordpress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an ajax request with a HTML code, which should receive a JSON object as ...
19
votes
8answers
2k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
2
votes
2answers
184 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
0
votes
1answer
71 views

SAPE link injection into website

I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed. The problem is this SAPE Russian link network that is injecting malware code into the ...
5
votes
1answer
142 views

Wordpress site redirects to different site when using https. Have I been hacked?

I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my ...
3
votes
1answer
131 views

malware attack on my website may have started a SOCKS server - please advise [duplicate]

A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability. Following advice in the answer to this question, which contains details of the attack, ...
1
vote
1answer
55 views

Compromised Wordpress Admin account risk

I am wondering what are the risks of a compromised Wordpress Admin account. Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access ...
2
votes
2answers
133 views

Is there any security concern to host Wordpress on the main web server?

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com. Now there ...
2
votes
4answers
246 views

Could a compromised WP database cause re-infection without the hacker needing to login into WP?

Is it possible that a compromised WordPress database could somehow be used to re-infect a website? I'm not talking about the hacker decoding user passwords and login into WP. I'm talking about the ...
0
votes
0answers
20 views

Wordpress cookie discloses admins username [closed]

My wordpress installation has two cookies whose values follows the following format: <admin_username>_<hashvalue> I understand disclosing admin username is a serious security issue. ...
1
vote
0answers
30 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
5
votes
1answer
301 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
2
votes
1answer
101 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
0
votes
1answer
110 views

Backdoor under Akismet wordpress plugin

my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's ...
1
vote
2answers
496 views

PHP - Need help to understand injected code

I discovered a lot of requests to a fishy file in a plugin on my Wordpress site. There, I found a long string, a mapping function for each character used in the string, and an excecution of the ...
1
vote
1answer
102 views

Encrypting sensitive data in a financial form

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
3
votes
1answer
250 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
-1
votes
1answer
102 views

How a backdoor can be uploaded? [closed]

I am inspecting a Wordpress web site for a client and I have found that some backdoor were present in the webroot folder. Now I have to understand how the attacker did that reviewing the source code ...
-1
votes
1answer
430 views

How to prevent ddos and brute-force attack by restricting IP's on Wordpress website

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below <Files wp-login.php> ...
0
votes
0answers
110 views

How are brute force attacks hitting my WP website after renaming wp-admin folder?

We maintain several wordpress websites which receive regular attempts at brute forcing the admin credentials. Part of our standard rollout package is installing the All in One WP Security and Firewall ...
0
votes
1answer
338 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
1
vote
2answers
69 views

How to block users from downloading an attachment of a timed WordPress -post before article goes live?

So I'm trying to solve how to block users from downloading an attachment of a timed WordPress -post before article goes live? Attachments work as uploads on a custom field in an article. My current ...
5
votes
1answer
636 views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
1
vote
1answer
634 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
1
vote
1answer
3k views

New DDos Attack on WordPress website

Recently I saw something new (at least for me) in log file [% tools.ua.random() %] as below: 199.246.2.10 - - [21/Aug/2014:13:25:15 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 ...
0
votes
1answer
284 views

Ubuntu 12.04 server attacked using Wordpress vulnerability (plugin?) [duplicate]

Env Rackspace cloud server Wordpress 3.9.1 Ubuntu 12.04 Linux web.mydomain.com 3.2.0-67-virtual #101-Ubuntu SMP Tue Jul 15 17:58:37 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux History These may ...
2
votes
1answer
220 views

Encrypted code in hacked wordpress site

I have a customer who wants me to "restore" his Wordpress page. I looked a little bit deeper in the codes and found the following code a few times in different files: http://pastebin.com/nL4i6t8x ...
2
votes
4answers
668 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
3
votes
2answers
132 views

What security risk does it mean if you have your db password and security token publicity available?

In Germany everyone is worried about a prominent political party that exposes their wp-config to the public: https://www.a***********r.de/wp-config.php How much of a security risk is that? The db, ...
4
votes
2answers
109 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
2answers
4k views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
0
votes
2answers
1k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
1
vote
1answer
170 views

WordPress Private Expoit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
2
votes
2answers
254 views

WordPress Hacked. Deny access via admin - helpful or not?

Does it actually help keep a site more secure to deny all access to WP admin and make changes directly on the FTP only? Our WP has been hacked twice now. It seems that everyone has a different idea ...
2
votes
1answer
1k views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
2
votes
1answer
295 views

Found this weird code in my Wordpress under wp-includes

I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this: <?php // Preventing a directory listing ...
1
vote
1answer
242 views

What attack requests “wp-admin” URLs without login cookies?

Looking through my Apache log files ("combined" log file record format), I see a large number of requests for URLs ending in "wp-admin". This is pretty weird, as my server doesn't run WordPress. I ...
0
votes
1answer
363 views

How can I recover from a hacked WordPress site and prevent future attacks?

I have a dedicated server running WordPress and have recently noticed that its been hacked and PHPShell a remote web server controller has been uploaded. This has let the hacker view and edit files ...
2
votes
2answers
484 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
-3
votes
2answers
130 views

What kind of virus attack is this? And what do I do now?

I have just inherited a running wordpress installation from another agency and the theme (twentyeleven) they are using for my client has been corrupted. This is what most of the theme's php files ...
-3
votes
1answer
731 views

Wordpress - cleartext admin credentials disclosure

I am testing my own wordpress blog against security issues with wpscan. Honestly I have never done that before and was shocked after I saw the result. One vulnerability of my wordpress site is: [+] ...
2
votes
1answer
103 views

Does it make sense to use two factor authentication with password protected wp-admin folder?

I've finished building my wordpress website and now, I'm concerned about the security of the website. To improve security, I'm using Google two factor authentication plugin while also ...
0
votes
1answer
224 views

WordPress theme infected by 5a9fa481.megaline.co malware

I have a wordpress website always updated. I'v developed a theme from scratch for it, so my theme is clean as it was always. I use strong passwords generated by specific tools. Last 3 days my website ...
1
vote
0answers
76 views

Emails about Referrer Bombing

I have received a couple of emails recently from site owners saying that they are finding referrer links in their stats with their URL path but my domain. So if a website has a page ...