2

There is a Wordpress blog running on Wordpress 4.0. Anyone having the company webmail can signup to the blog using their Google+ account and submit blog posts. Once posted they will be sent to some moderators and once it is reviewed moderator can post it on the blog. Whenever anew blog post is submitted for review all the moderators will receive a mail saying to review the post.

Now the problem: The moderators are receiving spam mails. Mail says that there is a new blog post to be reviewed. To review goto this link. The link is a normal link. Nothing seems fishy. But the author details are interesting. The authors are not members of the organization and hence they can't create blog posts. So that I cant think of this as a simple spamming trick. How such moderator mails are getting generated?

The authors had an email addresses like name@h.maybebest.com and name@nokiamail.com. What am I supposed to do? Am I hacked?

EDIT

The emails are being received from registered mail server and the link looks like a normal edit blog post link. But since there are no such real blog post it redirects to the blogs homepage.

Recently I have deleted all the unwanted users from the website and watched the new users carefully. Within 4 days new spam users are getting registered to the site. Around 100 users were registered in 4 days.

I have the New user registration feature disabled. Still how this happens?

  • 2
    You don't give nearly enough information to even provide an educated guess: are the email sent from the site mail server ? Are the links leading to articles in the web sites ? – Stephane Mar 27 '15 at 9:03
  • Yeah, the emails are being received from registered mail server and the link looks like a normal edit blog post link. But since there are no such real blog post it redirects to the blogs homepage. – Anonymous Platypus Mar 27 '15 at 9:07
2

I'm assuming there is no relation between these mails and any actual new posts to be reviewed, right? I.e., just be cause you receive one of these mails, there does not need to actually be a new blog post to review?

If this is the case, then I can't see any indication of any relation between these mails and your systems (the WP system). In other words, I can't see any reason to view this as anything other than "regular" spam.

As for the links, the fact that they point to your moderation page does not mean an attacker has access to your site`s internals - the url is probably just a standard url for WP sites, with the root url replaced with your site's address.

Edit: As mentioned in the comments below, the real issue is that the mails appear to be coming from the internal mail-server. This could perhaps indicate a breach (?), but should be verified by checking logs for the mail server to make sure the mails are not just manipulated to look as if they're from your server. If logging is not turned on, change that now, and check the logs next time such a mail is received.

(Sidenote: Why would someone do this? Perhaps as a way to try to bypass any mail-filtering system you have in place, in order to sneak in spam that would otherwise be stopped?)

  • I don't feel its regular spam because the spam mails are being sent from the mail server and not from any other personal mailers. It should not happen since a user who doesn't have a company webmail address shouldn't be allowed to make a blog post. (Yeah, there is no new posts created still the server sends such mails) – Anonymous Platypus Mar 27 '15 at 9:11
  • Are you saying the e-mails are being generated and sent from your internal mail-server? If so, that should have been more clear in your OP. Also, can you provide some details on how are you asserting this? The contents of the emails themselves can obviously be spoofed - but perhaps there is something in your mail-server logs that can confirm or rule out whether the mails really are sent from your internal systems? – Kjartan Mar 27 '15 at 9:29
  • Okey. Will check for the logs. Yeah the mails are sent from internal mail server. It exactly looks the same as an authorized mail. It doesn't have much in it except the link to the submitted blog post (In this case which redirects as I have mentioned.) – Anonymous Platypus Mar 27 '15 at 9:34
0

I don't have a specific answer for you, but if you search for "Wordpress hacked" you will begin to get an idea of the scope of the problem you face. My anecdotal experience is that Wordpress plugins tend to be responsible for a lot of the hacking that goes on, so I would start by patching your software stack from the OS up to Wordpress plugins and then looking at each of your installed plugins for known security holes. Someone is obviously getting into your Wordpress admin or user database through a security hole. Your challenge is finding and plugging the hole.

  • Its weird that so many people have reported these type of issues in official Wordpress forum. Many of them are years, almost 6, older. Its freaking that Wordpress didn't introduce anything so far to block 1000s of spammers who digs into Wordpress sites. – Anonymous Platypus Apr 6 '15 at 10:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.