Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [wordpress]

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

1
vote
2answers
126 views

Can a hacker determine what version of WordPress and PHP a site is using?

Can a hacker determine what version of WordPress and PHP a site is using? Assume this info is not available by View Source.
0
votes
0answers
11 views

Wp-cli problem, setup allow_url_fopen and open_basedir in php.ini

I have to set up allow_url_fopen = Off and open_basedir = /my-wp-site/ But I cannot use wp-cli if I do that. Any solution please?
0
votes
0answers
19 views

Is it possible to export WPScan results in excel file making it as an excel report?

I am running a python script which performs a vulnerability scanning using the WPScan tool and the results are saved as a txt file localy. Using that txt file I am not able to play with the results ...
0
votes
4answers
97 views

Trend Micro showing security warning on website. Unsure how to resolve it

I have a client with a website that sells a book. When someone clicks a button to purchase the book, a form is supposed to pop up (and does). However, I received a screenshot showing that, when that ...
0
votes
2answers
49 views

How to check if a list of domains contains any WordPress installation?

Does any software or any other way to detect if a website contains any WordPress installation? For example lets say we have the website example.com which is not a WordPress site, but we have a ...
0
votes
0answers
24 views

How various CMS encrypt password across past releases

I am interesting in knowing how Drupal, Wordpress and Joomla have managed password encryption (hashing algorithims) across their various releases, from the very first to the latest. Thanks.
0
votes
1answer
33 views

Why does thw JWT wordpress plugin recommend storing the token in a cookie/localstorage?

Reading about JWT I've come with a very interesting topic, which is the jwt tokens vulnerability if they're not properly secured when using with wordpress. So, the thing is that storing the token in ...
0
votes
1answer
79 views

How to fix WordPress CVE vulnerabilities or preventive measures?

I have a WordPress site r,unning on version 4.9.8. In the recent security audit done by the organization following issues were reported. 1) Wordpress: CVE-2017-1000600: Input Validation vulnerability ...
2
votes
1answer
107 views

How do I scan a WordPress website which blocks WPSCAN from scanning the website?

I am trying to scan a WordPress website with WPSCAN in Kali Linux but an error is happening. Whenever I start the scan WPSCAN runs for 2-3 min and gets paused and after some time and error comes "the ...
1
vote
1answer
60 views

wp-config leaked, how to change salts [closed]

define('SECURE_AUTH_KEY', define('AUTH_KEY', define('LOGGED_IN_KEY', define('NONCE_KEY', define('AUTH_SALT', define('SECURE_AUTH_SALT', define('LOGGED_IN_SALT', define(...
-1
votes
1answer
118 views

wpscan is not show the real version

When I scan WordPress site with wpscan I see in the results that I have version 2.10.3 in WP Rocket Title: WP Rocket <= 2.10.3 - Local File Inclusion (LFI) | Fixed in: 2.10.4 But I when I ...
0
votes
1answer
39 views

Are esc_* functions enough safe in WordPress? (like esc_url, esc_attr, esc_title)

WordPress has a number of built-in validation/sanitization functions. However, as we see, there are two kinds of such group: sanitize_* (like sanitize_key, sanitize_title, ...) esc_* (like esc_url, ...
-1
votes
1answer
73 views

Should I blacklist countries to stop brute force attacks?

I'm getting attacks at wp-admin from numerous countries and IPs. When I get a notification from Wordfence that there has been an attack, I blacklist the originating country from the WP backend. Then I ...
1
vote
1answer
74 views

I want to create a website, what aspects of security should I really care of? [duplicate]

I'm going to create a website with Wordpress. I'm a junior software developer myself and I have experience working with servers and with the Magento Ecommerce software. But I'm not a systems ...
2
votes
1answer
113 views

How long to wait before publishing a web vulnerability?

I recently learned about wpscan and the WordPress security, so I decided to try it with a blog from my company. As a result I got several serious vulnerabilities that must be fixed. I notified several ...
1
vote
0answers
29 views

WordPress email address leak [closed]

I recently changed an admin user email on a WordPress site that I manage. I used the same email address for the settings field within WP Admin. The new email address is completely unique and is not ...
-1
votes
2answers
89 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
0
votes
1answer
108 views

Any threats/SQL injections possible, when single-quote is being escaped?

Let's say, when server-side application (like WordPress) applies add_magic_quotes to all GET/POST parameters ( $_GET = add_magic_quotes($_GET); ), so calling the url: example.com/?id=a'b the app ...
0
votes
1answer
127 views

Is possible to attack a Wordpress website if someone know username and password of admin account?

Currently, I prevented accessing my wp-admin by htaccess as well as used functions.php to create a function to prevent accessing admin panel if the user is Admin. If someone knows the username and ...
2
votes
3answers
137 views

Do WordPress vulnerabilities matter in intranet?

My company is comsidering to use WordPress as an internal blogging platform. It would be installed on a server that is accessible only through our intranet, no exposure to outside world. It would only ...
1
vote
1answer
144 views

Change of DNS in MX records in a Wordpress site

I maintain qtechtheory.org, the website of my research group, which runs Wordpress and is hosted by BlueHost. Though we've been hit with PHP injection for several weeks, I've kept the site live since ...
2
votes
0answers
240 views

Digital Ocean WordPress droplet security precautions

I'm a front-end and WordPress developer. A week ago a number of my sites got hacked on shared hosting. The sites were built to a high standard, from scratch, using Underscores. I only use a small ...
-1
votes
1answer
96 views

How to stop wordpress attack with bot? [duplicate]

Here are some files that hackers modified. Inside my WordPress installation, I found an unknown folder called ID3 inside of a folder called ID3. three files 1.bots.php this is bots.php code GNU ...
1
vote
1answer
285 views

How to store an user access token on a third party site in the front end

I am working on a wordpress plugin that provides a comment thread system kind of like disqus (but different). In order to login (to post comments) the workflow is like this : User clicks on log-in ...
0
votes
1answer
79 views

Apache2 Logs, need help in identifying if it is an attack or not

Are this an example of an attack that had happened to my server? This happened few days before I checked the logs... I checked the logs to see if something was wrong since my server suddenly uses all ...
2
votes
1answer
809 views

Hacked Wordpress /index.php and /wp-content/themes/Avada/footer.php

I woke up today to see the top and bottom pages of my website displaying a link with text "Cheap Jerseys Free Shipping". I quickly went in and saw that /index.php and /wp-content/themes/Avada/footer....
0
votes
1answer
56 views

RxR__kyfet.php - Found this in the Root of my site's directory. What does it do? [duplicate]

While going through the root directory of my site I found this RxR__kyfet.php file. This is a wordpress site. I don't know php well enough to tell exactly what it does but it seems rather suspicious. ...
2
votes
1answer
479 views

How could a hacker access my Wordpress admin area?

I have two sites which appear to have been hacked. I checked the access logs and found these log entries: "GET / HTTP/1.1" 200 20213 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/...
1
vote
1answer
1k views

Disabling TLS 1.0/ on Wordpress

I run a Wordpress website on a OVH plan, so I don't have direct control over the server. I want to disable TLS V1.0 since it has known security vulnerabilities. Most guides I have found on this have ...
2
votes
0answers
80 views

Strange Wordpress access to /search activity

I have a wordpress site and periodically I see things like this in the access logs: 256.73.103.356 - - [10/Jun/2018:10:55:51 +0000] "HEAD /search/www.rijfk.cn HTTP/1.1" 200 0 "-" "-" 256.73.103.356 - ...
-1
votes
1answer
468 views

Obfuscated PHP code found on Wordpress site - has it been compromised? [duplicate]

Firstly - I expect the answer to be yes. But I never dealt with something like this so I would like some advice. A client has recently complained that their website went down. So I started ...
2
votes
1answer
2k views

Why might I want to remove the wlwmanifest.xml file in WordPress?

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the ...
-2
votes
1answer
90 views

How to force authentication over HTTPS - Wordpress

During our last PCI scan, we received these 2 fail points: "Basic Authentication over HTTP" and "Web Page Transmits Login Credentials Without Encryption." Both were on Port 2077. Though our ...
0
votes
2answers
320 views

Good Vulnerable Wordpress VM or Lab? [closed]

I am looking to dive into learning more about Wordpress vulnerabilities and conducting penetration testing against them. Are there any good "Vulnerable WP Sites?" that I can download as a VM to play ...
8
votes
1answer
992 views

How to report unsuccessful attacks to the source network admins? [duplicate]

I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic. I have set up a web store via WordPress using WooCommerce and ...
6
votes
1answer
2k views

Find the security hole on my site and prevent it [duplicate]

Last day I've noticed that my wordpress site is hacked and a PHP backdoor shell is installed on my site. Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not ...
1
vote
0answers
72 views

Wordpress detect plugins when wpscan fails

I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used wpscan in order to do ...
0
votes
0answers
320 views

Fake Wordpress reset password email with an external X-Google-Original-From header

My employer owns a Wordpress blog and I have an account with it used to submit blog posts. I have recently received a few password reset emails that link to an external site. These emails appear to ...
-4
votes
1answer
389 views

How can WPscan bruteforce passwords without hitting any limit rate?

I've just watched this video which shows the attacker bruteforcing both usernames and passwords. How can this be achieved without hitting any limit rate? Does it mean that WordPress doesn't provide ...
0
votes
1answer
115 views

How is the WordPress nonce generated?

I'm trying to reproduce the wordpress "nonce" parameter. How is it generated? How is it related to the cookies? From codex.wordpress.com: Nonces are generated using a key and salt that are unique ...
1
vote
1answer
437 views

analyzing hacked website log : is there any link between ./etc and ./tmp when uploading files? [closed]

One of my friends got hacked and asked me for help. This guy had a single shared host and uploaded like 20 websites on it and one of them got hacked and now all of them are full of shells. I asked ...
0
votes
1answer
135 views

Wordpress server compromised

I am running a wordpress website and suddenly cpu usage spiked to 100%. When I tried to dig in, I found a binary in php/tmp folder which was running with configuration file- { "algo": "...
1
vote
1answer
197 views

Fake referer is affecting my google search results

Google search result of my wordpress site is different than original content. We have taken services of security expert and they have scanned the site and database but there is no modification in code ...
2
votes
1answer
83 views

Protecting WordPress from a single machine DoS (either in network/web level)?

I use a DigitalOcean Ubuntu 16.04 machine with Bash, LEMP and WordPress. I already did the best I can to protect the system and WordPress from BFAs and Backdoors, and to protect WordPress from DB ...
1
vote
0answers
47 views

Malicious code found in Wordpress theme [duplicate]

I found the following code in a child theme's functions.php Even if you delete it it re-generates automatically if (isset($_REQUEST['action']) && isset($_REQUEST['password']) && ($...
3
votes
1answer
158 views

How to protect a website from DDoS without a CDN? [closed]

I have basic knowledge in Bash and with that knowledge I rented a remote machine in a mostly-self-managed hosting platform (DigitalOcean) and raised a LEMP environment on which I have a website. I ...
2
votes
2answers
652 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
1
vote
0answers
97 views

Strange crawl requests from google bot

My Wordpress web site recently had a strange crawl link from Google. This is the list of crawl errors on my Google Webmaster Tools page: Are these normal requests from google, or has my website been ...
0
votes
1answer
58 views

Inbound Ip Visited “localhost” wordpress stack on AWS

i'm testing a webserver on an aws EC2 instance, it has a wordpress stack on it. The domain is configured properly, public static(elastic ip) redirected to main domain as well as the aws public dns. So ...
19
votes
5answers
5k views

Is it possible to find a buffer overflow in WordPress?

I had an interesting conversation with a pentester who told me he had found a buffer overflow in Wordpress. The person in question was really adamant that this was true. The client is a bit skeptical ...