Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wordpress]

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

1
vote
0answers
19 views

WordPress email address leak [on hold]

I recently changed an admin user email on a WordPress site that I manage. I used the same email address for the settings field within WP Admin. The new email address is completely unique and is not ...
0
votes
0answers
10 views

Paypal api saving client id and secret

I am developing a web application (It is a point system, users do certain things and they receive points for it and I am using Wordpress for it) in php and I wanted to ask what is the best way to ...
0
votes
0answers
23 views

WordPress javascript code injection [duplicate]

Google notified me that there are malicious links on my website: https://cobalten.com/apu.php?zoneid=2025634 https://go.oclasrv.com/apu.php?zoneid=2025634 https://wowreality.info/page.js?wm=gr It's ...
0
votes
2answers
62 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
0
votes
1answer
43 views

Any threats/SQL injections possible, when single-quote is being escaped?

Let's say, when server-side application (like WordPress) applies add_magic_quotes to all GET/POST parameters ( $_GET = add_magic_quotes($_GET); ), so calling the url: example.com/?id=a'b the app ...
0
votes
1answer
117 views

Is possible to attack a Wordpress website if someone know username and password of admin account?

Currently, I prevented accessing my wp-admin by htaccess as well as used functions.php to create a function to prevent accessing admin panel if the user is Admin. If someone knows the username and ...
2
votes
3answers
119 views

Do WordPress vulnerabilities matter in intranet?

My company is comsidering to use WordPress as an internal blogging platform. It would be installed on a server that is accessible only through our intranet, no exposure to outside world. It would only ...
1
vote
1answer
63 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
2
votes
0answers
96 views

Digital Ocean WordPress droplet security precautions

I'm a front-end and WordPress developer. A week ago a number of my sites got hacked on shared hosting. The sites were built to a high standard, from scratch, using Underscores. I only use a small ...
-1
votes
1answer
60 views

How to stop wordpress attack with bot? [duplicate]

Here are some files that hackers modified. Inside my WordPress installation, I found an unknown folder called ID3 inside of a folder called ID3. three files 1.bots.php this is bots.php code GNU ...
1
vote
1answer
162 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
0
votes
1answer
76 views

Apache2 Logs, need help in identifying if it is an attack or not

Are this an example of an attack that had happened to my server? This happened few days before I checked the logs... I checked the logs to see if something was wrong since my server suddenly uses all ...
2
votes
1answer
377 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
0
votes
0answers
24 views

How to remove javascript malware in wordpress site? [duplicate]

I created a website in wordpress and suddenly realized malware in my site after google ads stopped and warned me. Below are the malwares found by sucuri sitecheck. <script type="text/javascript" ...
0
votes
1answer
50 views

RxR__kyfet.php - Found this in the Root of my site's directory. What does it do? [duplicate]

While going through the root directory of my site I found this RxR__kyfet.php file. This is a wordpress site. I don't know php well enough to tell exactly what it does but it seems rather suspicious. ...
2
votes
1answer
309 views

How could a hacker access my Wordpress admin area?

I have two sites which appear to have been hacked. I checked the access logs and found these log entries: "GET / HTTP/1.1" 200 20213 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/...
1
vote
1answer
480 views

Disabling TLS 1.0/ on Wordpress

I run a Wordpress website on a OVH plan, so I don't have direct control over the server. I want to disable TLS V1.0 since it has known security vulnerabilities. Most guides I have found on this have ...
2
votes
0answers
74 views

Strange Wordpress access to /search activity

I have a wordpress site and periodically I see things like this in the access logs: 256.73.103.356 - - [10/Jun/2018:10:55:51 +0000] "HEAD /search/www.rijfk.cn HTTP/1.1" 200 0 "-" "-" 256.73.103.356 - ...
-1
votes
1answer
236 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
1
vote
1answer
711 views

Why might I want to remove the wlwmanifest.xml file in WordPress?

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the ...
-2
votes
1answer
70 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
0
votes
2answers
104 views

Good Vulnerable Wordpress VM or Lab? [closed]

I am looking to dive into learning more about Wordpress vulnerabilities and conducting penetration testing against them. Are there any good "Vulnerable WP Sites?" that I can download as a VM to play ...
8
votes
1answer
868 views

How to report unsuccessful attacks to the source network admins? [duplicate]

I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic. I have set up a web store via WordPress using WooCommerce and ...
6
votes
1answer
2k views

Find the security hole on my site and prevent it [duplicate]

Last day I've noticed that my wordpress site is hacked and a PHP backdoor shell is installed on my site. Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not ...
1
vote
0answers
50 views

Wordpress detect plugins when wpscan fails

I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used wpscan in order to do ...
0
votes
0answers
197 views

Fake Wordpress reset password email with an external X-Google-Original-From header

My employer owns a Wordpress blog and I have an account with it used to submit blog posts. I have recently received a few password reset emails that link to an external site. These emails appear to ...
-4
votes
1answer
274 views

How can WPscan bruteforce passwords without hitting any limit rate?

I've just watched this video which shows the attacker bruteforcing both usernames and passwords. How can this be achieved without hitting any limit rate? Does it mean that WordPress doesn't provide ...
0
votes
1answer
94 views

How is the WordPress nonce generated?

I'm trying to reproduce the wordpress "nonce" parameter. How is it generated? How is it related to the cookies? From codex.wordpress.com: Nonces are generated using a key and salt that are unique ...
1
vote
1answer
337 views

analyzing hacked website log : is there any link between ./etc and ./tmp when uploading files? [closed]

One of my friends got hacked and asked me for help. This guy had a single shared host and uploaded like 20 websites on it and one of them got hacked and now all of them are full of shells. I asked ...
0
votes
1answer
127 views

Wordpress server compromised

I am running a wordpress website and suddenly cpu usage spiked to 100%. When I tried to dig in, I found a binary in php/tmp folder which was running with configuration file- { "algo": "...
1
vote
1answer
145 views

Fake referer is affecting my google search results

Google search result of my wordpress site is different than original content. We have taken services of security expert and they have scanned the site and database but there is no modification in code ...
2
votes
1answer
75 views

Protecting WordPress from a single machine DoS (either in network/web level)?

I use a DigitalOcean Ubuntu 16.04 machine with Bash, LEMP and WordPress. I already did the best I can to protect the system and WordPress from BFAs and Backdoors, and to protect WordPress from DB ...
1
vote
0answers
47 views

Malicious code found in Wordpress theme [duplicate]

I found the following code in a child theme's functions.php Even if you delete it it re-generates automatically if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($...
3
votes
1answer
151 views

How to protect a website from DDoS without a CDN? [closed]

I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website. I ...
2
votes
2answers
475 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
0
votes
0answers
19 views

What are best practices to secure WordPress site? Not to have WP at all? [duplicate]

The never-ending list of everyday detected vulnerabilities in WordPress, makes me wonder to have another CMS (but WP is really marvellous for me). There are many good people reporting issues to WP, ...
1
vote
0answers
91 views

Strange crawl requests from google bot

My Wordpress web site recently had a strange crawl link from Google. This is the list of crawl errors on my Google Webmaster Tools page: Are these normal requests from google, or has my website been ...
0
votes
1answer
48 views

Inbound Ip Visited “localhost” wordpress stack on AWS

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So ...
19
votes
5answers
5k views

Is it possible to find a buffer overflow in WordPress?

I had an interesting conversation with a pentester who told me he had found a buffer overflow in Wordpress. The person in question was really adamant that this was true. The client is a bit skeptical ...
1
vote
1answer
193 views

limit malicious log in attempts on wordpress site

Following my previous question, I have installed an "activity log" plugin on my site, from this I can see several malicious log in attempts. In above image we can see a new attempt each second, these ...
1
vote
2answers
295 views

Prevent Brute force attacks on WordPress with SSHguard

I've installed sshguard: sudo apt-get sshguard -y and it works fine (I tried to "brute force" my own server and was blocked). I desire to utilize sshguard to defend form brute force attacks on ...
4
votes
1answer
161 views

A bot edited all pages on my Wordpress installation

I manage a Wordpress site for an event registration. The site is only active for a few months a year. The rest of the year it's idle, as in it's up, but not actively maintained. Now the time has come ...
0
votes
3answers
493 views

Are old Wordpress versions still secure?

I checked a Wordpress instances with https://hackertarget.com/wordpress-security-scan/ and it told me that the Wordpress version is 4.7.9 and that I should update. True, current version is 4.9.2, but ...
2
votes
1answer
34 views

webapp directories should have the directory name as owner and group?

Some programmer told me that my usual way to change ownership and permissions to my webapp dirs isn't good: sudo chown www-data:www-data /var/www/html/* -R He told me that this could result in a ...
0
votes
1answer
359 views

Pentest a WordPress installation

I will help a friend to test the security behind their WordPress site. I thought about to start to do a scan with Burpsuite and also WPScan, I also believe I will find a acunetix useful. When I read ...
3
votes
1answer
159 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
4
votes
1answer
3k views

How does this Wordpress site got infected with vlomaw.zip, tondjr.zip, oniyur.zip

I would like to know if anyone knows where does this attack came from? One of our customer's sites was infected by a code which generated several files like: 0b37a.php.suspected 5394bb9efbe.php ...
0
votes
1answer
266 views

PHP Backdoor on live server [duplicate]

Suddenly one of our Wordpress websites started sending spam emails and it was blacklisted on MXToolBox. So with the server support I scaned the files and found a strange file called timer.php ...
4
votes
2answers
515 views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
3
votes
1answer
131 views

Q: Need help understanding hacked site that only impacts AT&T LTE users

I'm almost certain my (new) client's wordpress site is hacked. The home page is fine, but every subdirectory on the page loads with very sketchy content seemingly injected into the page. But here's ...