Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

2
votes
0answers
52 views

Digital Ocean WordPress droplet security precautions

I'm a front-end and WordPress developer. A week ago a number of my sites got hacked on shared hosting. The sites were built to a high standard, from scratch, using Underscores. I only use a small ...
-1
votes
1answer
43 views

How to stop wordpress attack with bot? [duplicate]

Here are some files that hackers modified. Inside my WordPress installation, I found an unknown folder called ID3 inside of a folder called ID3. three files 1.bots.php this is bots.php code GNU ...
0
votes
1answer
43 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
0
votes
1answer
68 views

Apache2 Logs, need help in identifying if it is an attack or not

Are this an example of an attack that had happened to my server? This happened few days before I checked the logs... I checked the logs to see if something was wrong since my server suddenly uses all ...
2
votes
1answer
130 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
0
votes
0answers
24 views

How to remove javascript malware in wordpress site? [duplicate]

I created a website in wordpress and suddenly realized malware in my site after google ads stopped and warned me. Below are the malwares found by sucuri sitecheck. <script type="text/javascript" ...
0
votes
1answer
47 views

RxR__kyfet.php - Found this in the Root of my site's directory. What does it do? [duplicate]

While going through the root directory of my site I found this RxR__kyfet.php file. This is a wordpress site. I don't know php well enough to tell exactly what it does but it seems rather suspicious. ...
2
votes
1answer
184 views

How could a hacker access my Wordpress admin area?

I have two sites which appear to have been hacked. I checked the access logs and found these log entries: "GET / HTTP/1.1" 200 20213 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/...
1
vote
1answer
156 views

Disabling TLS 1.0/ on Wordpress

I run a Wordpress website on a OVH plan, so I don't have direct control over the server. I want to disable TLS V1.0 since it has known security vulnerabilities. Most guides I have found on this have ...
2
votes
0answers
71 views

Strange Wordpress access to /search activity

I have a wordpress site and periodically I see things like this in the access logs: 256.73.103.356 - - [10/Jun/2018:10:55:51 +0000] "HEAD /search/www.rijfk.cn HTTP/1.1" 200 0 "-" "-" 256.73.103.356 - ...
-1
votes
1answer
121 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
0
votes
1answer
198 views

Why might I want to remove the wlwmanifest.xml file in WordPress?

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the ...
-2
votes
1answer
62 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
0
votes
1answer
67 views

Good Vulnerable Wordpress VM or Lab?

I am looking to dive into learning more about Wordpress vulnerabilities and conducting penetration testing against them. Are there any good "Vulnerable WP Sites?" that I can download as a VM to play ...
8
votes
1answer
849 views

How to report unsuccessful attacks to the source network admins? [duplicate]

I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic. I have set up a web store via WordPress using WooCommerce and ...
6
votes
1answer
1k views

Find the security hole on my site and prevent it [duplicate]

Last day I've noticed that my wordpress site is hacked and a PHP backdoor shell is installed on my site. Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not ...
1
vote
0answers
43 views

Wordpress detect plugins when wpscan fails

I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used wpscan in order to do ...
0
votes
0answers
112 views

Fake Wordpress reset password email with an external X-Google-Original-From header

My employer owns a Wordpress blog and I have an account with it used to submit blog posts. I have recently received a few password reset emails that link to an external site. These emails appear to ...
-4
votes
1answer
164 views

How can WPscan bruteforce passwords without hitting any limit rate?

I've just watched this video which shows the attacker bruteforcing both usernames and passwords. How can this be achieved without hitting any limit rate? Does it mean that WordPress doesn't provide ...
0
votes
1answer
91 views

How is the WordPress nonce generated?

I'm trying to reproduce the wordpress "nonce" parameter. How is it generated? How is it related to the cookies? From codex.wordpress.com: Nonces are generated using a key and salt that are unique ...
1
vote
1answer
248 views

analyzing hacked website log : is there any link between ./etc and ./tmp when uploading files? [closed]

One of my friends got hacked and asked me for help. This guy had a single shared host and uploaded like 20 websites on it and one of them got hacked and now all of them are full of shells. I asked ...
0
votes
1answer
121 views

Wordpress server compromised

I am running a wordpress website and suddenly cpu usage spiked to 100%. When I tried to dig in, I found a binary in php/tmp folder which was running with configuration file- { "algo": "...
1
vote
1answer
120 views

Fake referer is affecting my google search results

Google search result of my wordpress site is different than original content. We have taken services of security expert and they have scanned the site and database but there is no modification in code ...
2
votes
1answer
75 views

Protecting WordPress from a single machine DoS (either in network/web level)?

I use a DigitalOcean Ubuntu 16.04 machine with Bash, LEMP and WordPress. I already did the best I can to protect the system and WordPress from BFAs and Backdoors, and to protect WordPress from DB ...
1
vote
0answers
47 views

Malicious code found in Wordpress theme [duplicate]

I found the following code in a child theme's functions.php Even if you delete it it re-generates automatically if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($...
3
votes
1answer
145 views

How to protect a website from DDoS without a CDN? [closed]

I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website. I ...
2
votes
2answers
362 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
0
votes
0answers
18 views

What are best practices to secure WordPress site? Not to have WP at all? [duplicate]

The never-ending list of everyday detected vulnerabilities in WordPress, makes me wonder to have another CMS (but WP is really marvellous for me). There are many good people reporting issues to WP, ...
1
vote
0answers
88 views

Strange crawl requests from google bot

My Wordpress web site recently had a strange crawl link from Google. This is the list of crawl errors on my Google Webmaster Tools page: Are these normal requests from google, or has my website been ...
0
votes
1answer
44 views

Inbound Ip Visited “localhost” wordpress stack on AWS

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So ...
19
votes
5answers
5k views

Is it possible to find a buffer overflow in WordPress?

I had an interesting conversation with a pentester who told me he had found a buffer overflow in Wordpress. The person in question was really adamant that this was true. The client is a bit skeptical ...
1
vote
1answer
163 views

limit malicious log in attempts on wordpress site

Following my previous question, I have installed an "activity log" plugin on my site, from this I can see several malicious log in attempts. In above image we can see a new attempt each second, these ...
1
vote
2answers
265 views

Prevent Brute force attacks on WordPress with SSHguard

I've installed sshguard: sudo apt-get sshguard -y and it works fine (I tried to "brute force" my own server and was blocked). I desire to utilize sshguard to defend form brute force attacks on ...
4
votes
1answer
157 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
0
votes
3answers
357 views

Are old Wordpress versions still secure?

I checked a Wordpress instances with https://hackertarget.com/wordpress-security-scan/ and it told me that the Wordpress version is 4.7.9 and that I should update. True, current version is 4.9.2, but ...
2
votes
1answer
34 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
0
votes
1answer
317 views

Pentest a WordPress installation

I will help a friend to test the security behind their WordPress site. I thought about to start to do a scan with Burpsuite and also WPScan, I also believe I will find a acunetix useful. When I read ...
3
votes
1answer
151 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
4
votes
1answer
2k views

How does this Wordpress site got infected with vlomaw.zip, tondjr.zip, oniyur.zip

I would like to know if anyone knows where does this attack came from? One of our customer's sites was infected by a code which generated several files like: 0b37a.php.suspected 5394bb9efbe.php ...
0
votes
1answer
215 views

PHP Backdoor on live server [duplicate]

Suddenly one of our Wordpress websites started sending spam emails and it was blacklisted on MXToolBox. So with the server support I scaned the files and found a strange file called timer.php ...
4
votes
2answers
416 views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
3
votes
1answer
128 views

Q: Need help understanding hacked site that only impacts AT&T LTE users

I'm almost certain my (new) client's wordpress site is hacked. The home page is fine, but every subdirectory on the page loads with very sketchy content seemingly injected into the page. But here's ...
0
votes
0answers
35 views

Obfuscated php code found on wordpress folder [duplicate]

I found this piece of code hiding under wp-includes/.sys.gvi.php on a wordpress server. <?php @error_reporting(0); if($_COOKIE['PHPSESSID']=='55a67605ef99fca5125ef0f9691d3c46'){ $_e = explode(" ","...
2
votes
1answer
238 views

How does this backdoor work?

I just found that one of my wordpress websites included backdoor (my guess). As I see now, the same file on server is different than original on my laptop drive. So I think my website is already ...
4
votes
2answers
770 views

What is the best way to prevent code injection in Apache/PHP?

I have recently setup wordpress on a VPS, and it is under continuous attack since. I have taken some measures to protect from some bruteforce attacks, however looking at some of the logs I am not sure ...
1
vote
1answer
64 views

How to interpret SELinux boolean allow rules?

I'm trying to understand what permissions are allowed by some of the SELinux booleans for httpd domain, as it is my main source of concern, and the current policy of my organization is to give truly ...
1
vote
0answers
165 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
1
vote
0answers
359 views

php-reverse-shell in Wordpress can't connect to netcat

I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to ...
1
vote
2answers
238 views

Wordpress 4.7.6 vulnerabilities? [closed]

I have a wordpress 4.7.6 without plugins, however, I've noticed this: https://cxsecurity.com/cveshow/CVE-2017-14723 And the other vulnerabilities that are <4.8.2. My question is, I have tried to ...
5
votes
1answer
212 views

Why is Google using Local File Inclusion and Directory Traversal attempts on my site

If have a firewall on my wordpress site and it has blocked Google from attempting both Local File Inclusion and Directory Traversal attempts. Why would Google be doing this? United States Mountain ...