WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine.

learn more… | top users | synonyms

1
vote
0answers
13 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
5
votes
1answer
207 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
0
votes
1answer
72 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
0
votes
1answer
43 views

Backdoor under Akismet wordpress plugin

my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's ...
0
votes
2answers
162 views

PHP - Need help to understand injected code

I discovered a lot of requests to a fishy file in a plugin on my Wordpress site. There, I found a long string, a mapping function for each character used in the string, and an excecution of the ...
1
vote
1answer
84 views

Encrypting sensitive data in a financial form

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
3
votes
1answer
126 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
-1
votes
1answer
75 views

How a backdoor can be uploaded? [closed]

I am inspecting a Wordpress web site for a client and I have found that some backdoor were present in the webroot folder. Now I have to understand how the attacker did that reviewing the source code ...
-1
votes
1answer
218 views

How to prevent ddos and brute-force attack by restricting IP's on Wordpress website

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below <Files wp-login.php> ...
0
votes
0answers
82 views

How are brute force attacks hitting my WP website after renaming wp-admin folder?

We maintain several wordpress websites which receive regular attempts at brute forcing the admin credentials. Part of our standard rollout package is installing the All in One WP Security and Firewall ...
0
votes
1answer
247 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
1
vote
2answers
56 views

How to block users from downloading an attachment of a timed WordPress -post before article goes live?

So I'm trying to solve how to block users from downloading an attachment of a timed WordPress -post before article goes live? Attachments work as uploads on a custom field in an article. My current ...
5
votes
1answer
293 views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
1
vote
1answer
413 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
1
vote
1answer
2k views

New DDos Attack on WordPress website

Recently I saw something new (at least for me) in log file [% tools.ua.random() %] as below: 199.246.2.10 - - [21/Aug/2014:13:25:15 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 ...
0
votes
1answer
190 views

Ubuntu 12.04 server attacked using Wordpress vulnerability (plugin?) [duplicate]

Env Rackspace cloud server Wordpress 3.9.1 Ubuntu 12.04 Linux web.mydomain.com 3.2.0-67-virtual #101-Ubuntu SMP Tue Jul 15 17:58:37 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux History These may ...
2
votes
1answer
189 views

Encrypted code in hacked wordpress site

I have a customer who wants me to "restore" his Wordpress page. I looked a little bit deeper in the codes and found the following code a few times in different files: http://pastebin.com/nL4i6t8x ...
2
votes
4answers
425 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
3
votes
2answers
125 views

What security risk does it mean if you have your db password and security token publicity available?

In Germany everyone is worried about a prominent political party that exposes their wp-config to the public: https://www.a***********r.de/wp-config.php How much of a security risk is that? The db, ...
4
votes
2answers
96 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
2answers
2k views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
0
votes
1answer
718 views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a wordpress site ,first thing come's in your mind is WPScan[http://wpscan.org/].While pentesting through some site's ,i faced a similar issue i.e it shows that ...
1
vote
1answer
159 views

WordPress Private Expoit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
2
votes
2answers
220 views

WordPress Hacked. Deny access via admin - helpful or not?

Does it actually help keep a site more secure to deny all access to WP admin and make changes directly on the FTP only? Our WP has been hacked twice now. It seems that everyone has a different idea ...
2
votes
1answer
882 views

Visitors logs show \x80w\x01\x03\x01 the HNAP1

Can anyone tell me what this means? I'm on Bluehost with a shared server. [ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address ...
2
votes
1answer
237 views

Found this weird code in my Wordpress under wp-includes

I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this: <?php // Preventing a directory listing ...
1
vote
1answer
185 views

What attack requests “wp-admin” URLs without login cookies?

Looking through my Apache log files ("combined" log file record format), I see a large number of requests for URLs ending in "wp-admin". This is pretty weird, as my server doesn't run WordPress. I ...
0
votes
1answer
273 views

How can I recover from a hacked WordPress site and prevent future attacks?

I have a dedicated server running WordPress and have recently noticed that its been hacked and PHPShell a remote web server controller has been uploaded. This has let the hacker view and edit files ...
2
votes
2answers
406 views

Does reverse proxy between two web servers impact security of both?

Situation: Consider the site: example.com, hosted at web server A. A WordPress blog is to be installed on a different web server, B. In order to route a WordPress installation to a subdirectory on ...
-3
votes
2answers
128 views

What kind of virus attack is this? And what do I do now?

I have just inherited a running wordpress installation from another agency and the theme (twentyeleven) they are using for my client has been corrupted. This is what most of the theme's php files ...
-3
votes
1answer
685 views

Wordpress - cleartext admin credentials disclosure

I am testing my own wordpress blog against security issues with wpscan. Honestly I have never done that before and was shocked after I saw the result. One vulnerability of my wordpress site is: [+] ...
2
votes
1answer
98 views

Does it make sense to use two factor authentication with password protected wp-admin folder?

I've finished building my wordpress website and now, I'm concerned about the security of the website. To improve security, I'm using Google two factor authentication plugin while also ...
0
votes
1answer
205 views

WordPress theme infected by 5a9fa481.megaline.co malware

I have a wordpress website always updated. I'v developed a theme from scratch for it, so my theme is clean as it was always. I use strong passwords generated by specific tools. Last 3 days my website ...
1
vote
0answers
72 views

Emails about Referrer Bombing

I have received a couple of emails recently from site owners saying that they are finding referrer links in their stats with their URL path but my domain. So if a website has a page ...
1
vote
4answers
437 views

How to figure out who is pummeling my WP install with bogus login attempts

I have a WordPress install which uses the plugin Wordfence. I set Wordfence to block the IP of anyone trying to log in with a non-existent username. For several months now, I have been getting many ...
1
vote
1answer
344 views

WordPress Comment Hacking Attempt

Recently Akismet asked me to moderate a possible spam comment on my blog. It was: <!--mfunc ...
2
votes
3answers
150 views

A scammer placed a remote file on a Wordpress website?

A previous developer I have used has got upset and start compromising the files of my website on daily bases (such as changing the index of the site with weird messages, deleting the .htaccess, ...
4
votes
1answer
85 views

Is there any danger in the preview button in blogs?

In my Wordpress blog (though this may be true of other blogs too), there is a preview web page feature. So when I get a comment with a link, I can hover over the link, and it shows me a preview of ...
6
votes
3answers
1k views

Is it possible to use Greasemonkey to hack a website?

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I ...
2
votes
1answer
317 views

Are GET, POST and windows.location vulnerable to XSS in a Wordpress theme?

I created a Wordpress theme for my client. He told me that he scanned my theme with a vulnerability scanner, and that it has security issues with the GET and windows.location methods. Is this really ...
1
vote
1answer
2k views

WordPress Hacked - Found a suspicious “class-wp-style-table.php” [closed]

I recently had all of my WordPress accounts on my server hacked. The only suspicious files I found are listed below. These were the only files edited in the last 5 days (June 3, to be specific). ...
7
votes
4answers
995 views

Does disabling .htaccess improve security?

I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
0
votes
2answers
1k views

Stopping js malware injection on our Wordpress site

This had been added to our wordpress site, specifically in the footer.php. hxxp://pkktjuchlrv.peguards.cc/02b31ac5iq/get.js It is malware as defined by google, i belive it is tracking code. We have ...
2
votes
1answer
285 views

Understanding what bot was used for a Botnet attack

Yesterday we got to know of a massive brute force attack on WordPress admin accounts targeting weak passwords. From an online source: A botnet using more than 90,000 IP addresses to crack ...
3
votes
2answers
263 views

Will using SSL to secure Wordpress admin area only still actually be secure?

The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas. There ...
1
vote
2answers
965 views

What vulnerabilities in the OWASP Top 10 are relevant to WordPress?

I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed? I know injections and XSS are ...
7
votes
1answer
986 views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
3
votes
2answers
885 views

Is WordPress a security vulnerability inside a corporate intranet?

The company I work for had me develop a WordPress site for their intranet. Now they are saying that it poses security risks and they would like to shut it down and have me use another CMS (SharePoint ...
2
votes
1answer
197 views

Determining how my Wordpress website was compromised

I have got a blog running Wordpress. The last time I visited my blog I realized it was hacked. The website redirects to a phishing page of paypal meanwhile other links a opening fine. I want to know ...
3
votes
1answer
174 views

Malicious php scripts in word press theme folder?

I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in ...