0

I have a small Wordpress website using contact form 7. I received messages that look like an attempt to hack my website:

From: <div style="background-color:#4169E1; margin:auto;
max-width:400px;border-radius:10px; font-family:tahoma,geneva,sans-serif;
font-size:20px;color:white;text-align:center;padding:20px">
<h1>🌍 Hello World!</h1>
</div>*hs=031ec7c737f96b496f6517b5ba4350ee*<div style="display:none">
<[email protected]>

Subject: 6plvk2

Phone: 459453819302

Message:
frqww2

Notes:

  • I changed the email adress
  • I added extra line breaks to improve readability

What is this person trying to do?

After that, I enabled reCaptcha with contact form 7. My admin account has 2FA enabled.

Is there something else I can do to protect my website from this?

2 Answers 2

2

Yes, it's often no more serious than spam, but it could be worse than that if the form allows header injection.

See here for example for an explanation. This is potentially serious, because the form could be hijacked to send spam to third parties. Your server will effectively act like an open relay.

This will cause poor IP reputation, being listed in various blacklists such as Spamhaus, and you will yourself encounter E-mail deliverability issues because of that.

So you will often see probing attempts from bots and spammers trying to exploit your contact form.

I assume the plugin follows best practices and is not vulnerable, but I have not audited its code. It would be interesting to test how it handles multi-line input for the From field for instance.

But I am surprised it did not validate the E-mail address more in depth, if it really looks like what you have shown. Then I would start questioning the quality of this plugin.

I suggest you test your own form by feeding garbage to verify how it works. Also check if there are configuration options you may have overlooked.

I suppose the HTML markup relates to the "name" field. The E-mail address itself should have been validated by the plugin.

3
  • I hope what you said will not happen to me :(! I'll have a look at what you advised me. Thanks!
    – Plouff
    Commented Jun 19, 2023 at 16:22
  • Contact Form 7 uses the standard wp_mail function which in turn is based on the widely used PHPMailer library. Of course nobody can guarantee you that PHPMailer is free of any vulnerabilities (it did have several vulnerabilities in the past), but this is a fairly big open-source project, not some toy software written by a hobbyist who has never heard of header injection attacks. So no need to panic. Keep the plug-in up to date, double-check the configuration as suggested, maybe investigate the validation issue. But currently, there's no indication of an attack, let alone a successful attack.
    – Ja1024
    Commented Jun 19, 2023 at 18:46
  • In fact PHPMailer has had header vulnerabilities in the past. But it's way more secure that using the plain mail() function.
    – Kate
    Commented Jun 19, 2023 at 19:22
2

I see no attack here. This looks more like plain old spam.

There's nothing inherently dangerous about receiving nonsense messages. In fact, it's quite normal. If you want to reduce spam, CAPTCHAs are a good first step. Spam filters like Rspamd and block lists like Stop Forum Spam can also help to some degree.

You may also validate the input fields more strictly. If you expect an e-mail address in the From field, then the input should in fact be an e-mail address. This will at least stop poorly written bots.

3
  • I see the attack: it's probing for Header Injection. It's probing to see if it's possible to send multiple email messages from the contact form.
    – ThoriumBR
    Commented Jun 19, 2023 at 15:46
  • No, it's not. The point of a header injection attack is to, well, actually inject headers. This isn't happening here.
    – Ja1024
    Commented Jun 19, 2023 at 16:01
  • Thanks for your answer. I accepted Kate answer since there is more details about the consequences. Have a nice day.
    – Plouff
    Commented Jun 19, 2023 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .