Questions tagged [wordpress]

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

Filter by
Sorted by
Tagged with
0
votes
2answers
75 views

Unusual file permissions on WordPress websites

I've been asked by a customer of mine, to manage a few hundred WordPress sites. Doing an initial security assessment, I've found that every site (350 sites) has unusual file permissions on every php ...
-2
votes
1answer
63 views

Can I upload a reverse shell to a website remotely if directory listing is enabled? [closed]

Can I upload a PHP reverse shell to a WordPress website if there is a directory listing vulnerability in the website? The condition is that I can see the entire file structure of /wp-includes in a ...
3
votes
2answers
1k views

Privilege Escalation Wordpress

I have access to a Wordpress blog and want to read the server's /root directory that belongs to the user "root" and not "www-data". I also know his password, but I can't open an interactive shell to ...
1
vote
0answers
45 views

Mod-security and WordPress WAF

On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence. I was wondering if a better practice would be to replace them with a host-based ...
17
votes
5answers
5k views

Can I check the content of a suspicious file directly on the server using an editor, e.g. vim?

in the Wordpress directory I found some suspicious-looking files with random strings in their name e.g. uxs5sxp59f_index.php. Can I safely check their content ? I have a suspicion that the site has ...
3
votes
1answer
282 views

What is a good method to report security breaches that are being used to actively spam?

I received an email the other day purporting to be from a bank I hadn't even heard of, so I decided to poke around. On some quick investigation, it looks like something has just latched onto some poor ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
0
votes
0answers
43 views

Dreamhost hosted wordpress site attacked - SSH password was changed - Need help assesing attack vector

My client had his wordpress site attacked, his site is not a juici target, the attack consisted in redirecting the site to another site. That in itself is no surprise, the weird thing is that both the ...
0
votes
2answers
75 views

hide_my_wp wordpress plugin is activated with php eval function that might trying to read /etc/passwd? Is it true?

When I install this plugin and activate in wordpress, hide_my_wp put some eval codes in wp_options and I see the following code being injected in a new row with the ID called 76624: upload-dir=./../../...
0
votes
0answers
48 views

Is it bad to let a file be downloaded using its direct path on WordPress?

I have a scenario that I want to let people that visit my WordPress website download some PDFs. These PDFs go to my website as products of the Woocommerce plugin, so they are stored on the folder ...
3
votes
2answers
276 views

What's the security risk in password recovery attempts

I'm the administrator of a Wordpress site, with just two users: me and one other user. Last days I've received multiple password recovery attempts for that other user (as an administrator I get a mail ...
0
votes
1answer
46 views

WordPress script injections [duplicate]

I manage an Ubuntu server that runs a number of WordPress sites. This morning one of them went down and was showing the exception PHP Fatal error: Namespace declaration statement has to be the very ...
1
vote
0answers
103 views

Vulnerability Reporting from “random” dude

A few days ago I got an email to our dpo email address from a person I don't know who claims to be a Security Researcher. The email is well written and contains a POC with screenshots of a CORS ...
0
votes
1answer
51 views

UFW does not block meterpreter

I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress. So I used the standard exploit in ...
0
votes
2answers
111 views

Scanning WordPress for security vulnerabilities

I am trying to use WordPress from Azure marketplace to deploy a web app. I ran a Fortify scan on entire code base (wwwroot) which includes wp-admin, wp-includes, wp-content and other boilerplate php ...
1
vote
1answer
100 views

Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?

I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. ...
0
votes
1answer
296 views

Why does the JWT Wordpress plugin recommend storing the token in a cookie/localstorage?

Reading about JWT I've come with a very interesting topic, which is the jwt tokens vulnerability if they're not properly secured when using with wordpress. So, the thing is that storing the token in ...
2
votes
1answer
284 views

DDoS Attack After Switching Hosts and Updating WordPress

I recently moved an old WordPress site from one hosting to Amazon Lightsail. Once the transfer was done, I noticed that WordPress, its plugins, and themes were all out of date. So, I updated them all. ...
1
vote
2answers
66 views

Wordpress Backups and Security

Apart from all the other security and design flaws of Wordpress, there is 1 point that particularly got my attention: "Automatic Backups". These are saved inside the Wordpress directory. If you ask ...
1
vote
0answers
43 views

Is using localhost for sensitive data secure?

I'm working with a nonprofit that wants to use CiviCRM to process its donor, member, and patron personal information. Civi is CMS-based, and will only run via WordPress, Drupal, Joomla, etc. Newb ...
8
votes
2answers
16k views

Why might I want to remove the wlwmanifest.xml file in WordPress?

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the ...
6
votes
3answers
2k views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
0
votes
0answers
25 views

How do I go about decoding this malicious PHP script? [duplicate]

I came upon this script just by luck, actually. Ironically, it's stored in a protected folder on my website and I don't think <? $catches ='r'; $comforter ='$r)ciEVi'; $heroin = 'SgD'; $...
0
votes
3answers
424 views

All 4 WP sites hosted in A2 Hosting were hacked

The hack redirects all my sites to another site All are running WP 5.4.1 (latest) and I even have a site that barely runs any plugins, just a simple open-source theme with 3 common plugins - Contact ...
1
vote
2answers
58 views

Wordpress versions 5.3 and 5.4

I am testing Wordpress website that is in 5.3.3 version, which is current and updated just few days ago (April 29, 2020). But there is also 5.4 branch, is it recommended to upgrade to 5.4 because it ...
1
vote
1answer
238 views

My WP site just got hacked for the third time even after following WP hardening guidelines

After the second hack, we did all the necessary things written here - https://wordpress.org/support/article/hardening-wordpress/ , https://security.stackexchange.com/a/180925 and we also changed the ...
0
votes
0answers
20 views

How to deobfuscate malicious PHP code [duplicate]

This is my first malware analyis, so apologies for my probably noob-like question. I'm having a look at a website running an outdated version of Wordpress which was hacked. The Website runs on a ...
2
votes
1answer
100 views

Are the developers of WordPress avoiding security by obscurity or there some reason to expose plugin and login names?

Tools like wpscan are out there in the open, which make the scanning of any WordPress website plugins without any authentication and receive sensitive data like wp-admin login names (which usually ...
0
votes
1answer
202 views

How to fix WordPress CVE vulnerabilities or preventive measures?

I have a WordPress site running on version 4.9.8. In the recent security audit done by the organization following issues were reported. 1) Wordpress: CVE-2017-1000600: Input Validation vulnerability ...
2
votes
4answers
1k views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
0
votes
2answers
323 views

Wordpress wp-config file seems hacked and changed to DB_NAME and DB_USER asadmin_drr and DB_HOST as 46.21.253.40 [duplicate]

I have a shared hosting on hostgator with around wordpress based websites. Out of them 4 stopped working with message as error establishing database connection. On checking the wp-config i found the ...
1
vote
1answer
109 views

How to identify malicious Wordpress user agents

I have noticed our website, which is Wordpress based, gets frequent daily requests from other sites where the user agent is Wordpress and the other site is obviously an already hacked Wordpress ...
4
votes
2answers
2k views

URL parameter manipulation and injection

I have a scenario with 2 sites. Site 1 is mysite.com and Site 2 is secondurl.com. Site 1 is using Wordpress. There, I did a Javascrit/jQuery routine that checks if a given url parameter comes in. If ...
0
votes
0answers
31 views

Wordpress m4shell Hack [duplicate]

I could not find any similar error after searching the web and struggling with the problem for around two weeks. One of the Wordpress sites I'm managing keeps getting hacked. There has been no ...
0
votes
1answer
199 views

Was my password copied? [closed]

I work locally with a WordPress site. When I logged in, it looked like the password was highlighted. It went very fast. Half a second maybe. I found it strange that it looked like it was marked, as in ...
1
vote
2answers
83 views

wordpress remote user authentication

I am having multiple wordpress sites with multiple users working on those. Therefore I would like to centeralize the user management, by having one authentication server, storing the username, ...
1
vote
1answer
318 views

WordPress private exploit? [closed]

I have a friend who said he has a private exploit for all WordPress ran websites. I asked him to take down my private blog, to see if it is real. He couldn't do it. I tried to get some more ...
0
votes
0answers
42 views

Alerts and warnings for Wordpress theme. What are the risks associated?

I have bought a Wordpress theme and scanned its files on www.themecheck.info. The results show 3 critical alerts and 9 warnings: Alerts: Presence of iframes : iframes are sometimes used to load ...
7
votes
3answers
6k views

Is it possible to use Greasemonkey to hack a website?

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I ...
1
vote
0answers
144 views

Wordpress site request to /wp-includes/Text/Diff/ yields open directory listing

Someone requested my site's (Wordpress/Apache) 'includes' directory: 122.51.0.219 - - [03/Oct/2019:18:36:15] "GET /wp-includes/Text/Diff/ HTTP/1.1" 200 736 "-" "-" Noticing the 200 response, I hit ...
2
votes
3answers
165 views

Multiple wp-login.php attack on shared hosting

I am hosting more than 20 WordPress website on a single server. The server has other cms based websites too. For better security, I have used CloudLinux CageFS which encapsulates each customer. Even ...
0
votes
0answers
78 views

How to Stop Cookies from Being Set

We're not using Adminer for database management yet for some reason adminer_sid & adminer_key cookies are being set in the browser - any idea how to stop them from being set? Where would they be ...
1
vote
2answers
114 views

How to prevent cross site scripting in wordpress?

I did source analyzer with third party services to my wordpress project. It found out that there are heaps of cross site scripting vulnerabilities. One of the example is like image below. How do I ...
5
votes
1answer
5k views

How does this Wordpress site got infected with vlomaw.zip, tondjr.zip, oniyur.zip

I would like to know if anyone knows where does this attack came from? One of our customer's sites was infected by a code which generated several files like: 0b37a.php.suspected 5394bb9efbe.php ...
-1
votes
1answer
48 views

How to limit access to wp-admin in case of a dynamic IP address? [closed]

I have dynamic IP address and I am trying to find the solution to limit the access to wp-admin. It seems that the only option is to block the access by domain name by using a Dynamic DNS Manager ...
2
votes
1answer
341 views

Just another suspiciously looking php script [duplicate]

My hosting blocked my website because malware, they say. I dived into the (shared) server via ssh and found a file that looks suspicious. This file was in an old, not working installation of wordpress ...
5
votes
1answer
339 views

While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take?

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc. ...
0
votes
1answer
685 views

Satoshi Nakamoto Renaissance Holdings' website is Wordpress? Is it safe? [closed]

So, Satoshi Nakamoto, creator of Bitcoin has announced that he will supposedly be revealing his real identity. I find the fact that Satoshi's company website is hosted on Wordpress to be endlessly ...
1
vote
1answer
138 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
11
votes
2answers
2k views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...

1
2 3 4 5 6