2

In my 13 years of Wordpress, I've never seen anything like this. About an hour ago I was alerted by one of my users that the website was displaying an Internal Server Error 500 message on every page. I consulted my host's tech support, and they were unable to determine the cause. I then noticed that I had about 20 comments in the moderation queue, all of which are very suspicious (see screenshot). I have no idea what to do. The website will load intermittently but it is very slow. I'm not sure what's going on, and I have no idea what to do. Any help would be greatly appreciated.

enter image description here

9
  • 1
    While the comment look suspicious and are probably the result of attempted SQL injection that's basically all the information we have. From this it looks like an attack was attempted. But it is unknown if it was successful, it is unknown if the 500 error is the result of the attack, what damage might have been done, how to recover ... - I think you need someone knowledgeable on-site instead which will look into the details, log files, what an attacker might have changed etc. This is not something which can be handled by a simple Q+A site like this. Commented Jun 30, 2021 at 4:36
  • 1
    @SteffenUllrich I'm thinking this may be a DDoS attack. I blocked the IP address used in the comments on Cloudflare and in just an hour it's blocked 40K+ requests from the IP. The site is loading consistently and faster now.
    – robertvs
    Commented Jun 30, 2021 at 5:09
  • 1
    "...this may be a DDoS attack ..." - The point of a DDoS attack is that it is distributed (that's the first "D" in DDoS), i.e. send from many many (possibly spoofed) IP addresses. This is obviously not the case here since it all originates from a single IP address. The contents of the comments instead looks like scanning for possible SQL injections (as I already said in my first comment). Commented Jun 30, 2021 at 6:13
  • 1
    Check the webserver logs. It's possible that one of the injections succeeded, and corrupted what WP expected to find, thus leading to a 500 error.
    – vidarlo
    Commented Jun 30, 2021 at 6:57
  • 1
    @borcho I'm using Cloudflare and Wordfence - would fail2ban conflict with either of those? Since blocking the IP used to make those comments, the site has returned to normal working order. However, I'm concerned there may have been permanent damage done somewhere that isn't overtly obvious.
    – robertvs
    Commented Jul 1, 2021 at 5:12

0

Browse other questions tagged .