Questions tagged [wordpress]

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

29 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
473 views

Digital Ocean WordPress droplet security precautions

I'm a front-end and WordPress developer. A week ago a number of my sites got hacked on shared hosting. The sites were built to a high standard, from scratch, using Underscores. I only use a small ...
2
votes
0answers
107 views

Strange Wordpress access to /search activity

I have a wordpress site and periodically I see things like this in the access logs: 256.73.103.356 - - [10/Jun/2018:10:55:51 +0000] "HEAD /search/www.rijfk.cn HTTP/1.1" 200 0 "-" "-" 256.73.103.356 - ...
2
votes
2answers
886 views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
1
vote
0answers
63 views

Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing

Someone requested my site's (Wordpress/Apache) 'includes' directory: 122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" Noticing the 200 response, I hit ...
1
vote
0answers
115 views

Wordpress detect plugins when wpscan fails

I was provided a challenge from a friend, where I have a latest wordpress installation with a vulnerable plugin. I was requested to detect the vulnerability so for that I used wpscan in order to do ...
1
vote
0answers
106 views

Strange crawl requests from google bot

My Wordpress web site recently had a strange crawl link from Google. This is the list of crawl errors on my Google Webmaster Tools page: Are these normal requests from google, or has my website been ...
1
vote
0answers
280 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
1
vote
0answers
765 views

php-reverse-shell in Wordpress can't connect to netcat

I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to ...
1
vote
0answers
44 views

WordPress site sends email from strange domains

I had a WordPress site with a security plugin configured to send me periodical database backups via email. This morning I noticed that I was receiving these emails as coming from two strange domains I ...
1
vote
0answers
93 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
1
vote
0answers
58 views

Compatibility issue if two wordpress security plugins are used together

My Wordpress installation uses sukuri as well as wordfence for security. Is there any possibilty that using both of them together might create any compatibility issues? I have this doubt because ...
1
vote
0answers
305 views

How are brute force attacks hitting my WP website after renaming wp-admin folder?

We maintain several wordpress websites which receive regular attempts at brute forcing the admin credentials. Part of our standard rollout package is installing the All in One WP Security and Firewall ...
1
vote
0answers
90 views

Emails about Referrer Bombing

I have received a couple of emails recently from site owners saying that they are finding referrer links in their stats with their URL path but my domain. So if a website has a page www.theirsite.com/...
0
votes
1answer
127 views

Wordpress wp-config file seems hacked and changed to DB_NAME and DB_USER asadmin_drr and DB_HOST as 46.21.253.40

I have a shared hosting on hostgator with around wordpress based websites. Out of them 4 stopped working with message as error establishing database connection. On checking the wp-config i found the ...
0
votes
0answers
30 views

Alerts and warnings for Wordpress theme. What are the risks associated?

I have bought a Wordpress theme and scanned its files on www.themecheck.info. The results show 3 critical alerts and 9 warnings: Alerts: Presence of iframes : iframes are sometimes used to load ...
0
votes
0answers
43 views

user_roles getting deleted from wp_options table in wordpress

I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL I am looking at the following: select * from wp_options opt where option_name like '%wp_user_roles%' order by ...
0
votes
0answers
56 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
0
votes
0answers
30 views

How to integrate an Oauth2 based application into a Wordpress plugin?

I'm working on a Wordpress plugin that integrates an external service. This service has an API that authenticates using OAuth 2.0. The plugin is public and can be used by anyone who has an account at ...
0
votes
0answers
32 views

Does the Loginizer WordPress plugin also limit XML-RPC-calls?

I learned about about XML-RPC and specifically XML-RPC in WordPress. Now, the safety of XML-RPC in WordPress this is disputed. But given, that I would like to continue using XML-RPC, in the most save ...
0
votes
0answers
117 views

Unkown attack on linux server wordpress website

I have a WordPress site. Recently under a serious DDoS attack. For this WordPress site I use nginx, varnish and apache in the backend. A part of access log shows this: 24.41.213.36 - - [23/Jun/...
0
votes
0answers
93 views

Problem Exploiting Plugin WPML 2.0.4.1 for Wordpress Vulnerability

First some context. I am Working for a company learning about Security Web Services. They have a main application and a blog. I've been looking vuln. in the main webapp for a while, but then I start ...
0
votes
0answers
254 views

Can the WordPress `wp-trackback.php` file introduce any security vulnerabilities?

I found that in the past, the WordPress version 2.0.6 and earlier was vulnerable. The remote host fails to properly sanitize input to the tb_id parameter of the wp-trackback.php script before using it ...
0
votes
0answers
32 views

Wp-cli problem, setup allow_url_fopen and open_basedir in php.ini

I have to set up allow_url_fopen = Off and open_basedir = /my-wp-site/ But I cannot use wp-cli if I do that. Any solution please?
0
votes
0answers
131 views

Is it possible to export WPScan results in excel file making it as an excel report?

I am running a python script which performs a vulnerability scanning using the WPScan tool and the results are saved as a txt file localy. Using that txt file I am not able to play with the results ...
0
votes
0answers
25 views

How various CMS encrypt password across past releases

I am interesting in knowing how Drupal, Wordpress and Joomla have managed password encryption (hashing algorithims) across their various releases, from the very first to the latest. Thanks.
0
votes
0answers
141 views

How to protect an outdated Wordpress Core and plugins

I have a Wordpress website from a client that was hacked (website is clean now). The Wordpress is version 3.3.1 and it has 42 active plugins. It's a nightmare in that installation, after many tries ...
-1
votes
1answer
262 views

wpscan is not show the real version

When I scan WordPress site with wpscan I see in the results that I have version 2.10.3 in WP Rocket Title: WP Rocket <= 2.10.3 - Local File Inclusion (LFI) | Fixed in: 2.10.4 But I when I ...
-1
votes
2answers
100 views

How can i access any useful information in a wordpress site?

While penetration testing for a university assignment, I found an exploit that might be the one the teacher has been hinting for, found here: https://www.exploit-db.com/exploits/45439/ I used it and ...
-1
votes
2answers
130 views

Website Loading Content from Malicious Sites

I own a website. Now today I find that when I load the site, Chrome shows "waiting for xxx.com" and some other unknown sites. I never added content or links from these sites. The website is running on ...