Skip to main content

Questions tagged [wordpress]

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

How do I unblock a request uri in Modsecurity CRS?

I have installed a Nginx WAF with Modsecurity CRS. This WAF protects a backend WordPress. One request from one of the plugins generated a false positive on the Modsecurity with the rule id 933120. I ...
Iogui's user avatar
  • 101
1 vote
2 answers
115 views

Can I set session time to 10 days without risking security issues?

We have a WordPress form that collects data on what marketing source (UTM) the user came from and upon submission, sends that UTM data to a 3rd party. Recently, a client asked me to have a web session ...
hyemark's user avatar
  • 11
2 votes
0 answers
266 views

WordPress site hacked [closed]

We got hacked. Our setup: DigitalOcean VPS, Apache, multiple domains & WP websites, Elementor Pro, hopefully safe plugins. Known facts: It's phishing. The virus infects all the websites on our ...
Ni Amon's user avatar
  • 29
4 votes
1 answer
269 views

Suspicious indexing of non-existent pages

Just recently, the Google search engine started indexing my site with a crazy number of requests. When I logged into the console, 600,000 pages were indexed, and 919,000 more were not indexed. For ...
Володька's user avatar
0 votes
1 answer
69 views

Can Caching cause my WAF logged events to drop?

I've been using Ninjafirewall on WordPress websites for a while. I recently installed a new caching plugin on my main website and I noticed the firewall log which usually has around 5000 blocked ...
KnightHawk's user avatar
0 votes
0 answers
25 views

i found an inserted script in all my pages and posts [duplicate]

I found this script in all my pages & posts and custom CSS. I want to delete it and prevent regenerating it again. This script stopped me from updating custom css in customize. please help if you ...
mohamed haddad's user avatar
0 votes
2 answers
259 views

What is this bot/person trying to do with my contact form:

I have a small Wordpress website using contact form 7. I received messages that look like an attempt to hack my website: From: <div style="background-color:#4169E1; margin:auto; max-width:...
Plouff's user avatar
  • 103
0 votes
1 answer
1k views

How to display first party website to third party website | inside the Iframe

I have www.example.com a WordPress website and www.official.com this third-party website, I want to invoke <iframe src="www.example.com"></iframe> in www.official.com Here my ...
Fasal Basha's user avatar
0 votes
2 answers
243 views

Someone attempted to hack our wordpress website

I found a file in the public folder of our website. Then I searched to find out how this file was uploaded. I finally found that it was uploaded via FTP. We have determined the IP and address to which ...
Bahadır ACAR's user avatar
0 votes
0 answers
104 views

Potential security risks of giving FTP account and wp-admin to Theme Support team on self-hosted wordpress.org site

I have a brand new WordPress.org website, so far there isn't any content uploaded. The hurdle is that as soon as I install the theme that I payed for, it crashes. The theme that I payed for (Lezada), ...
JGC's user avatar
  • 1
0 votes
0 answers
672 views

CVE 2022-21661 - WP Injection replication

I'm trying to replicate the vulnerability CVE 2022-21661 on my own website that is resulted vulnerable as according the versions involved, as according wp-scan. I'm trying to submit a POST request ...
Giacomo's user avatar
0 votes
0 answers
19 views

strange file name in user's home directory [duplicate]

I recently found a strange file in my user home directory. ~$ ls -li total 16 ... 262994 -rw-r--r-- 1 user1 user1 0 Jul 14 12:13 ''$'\020\243''end'$'\202\243''row̹'$'\246''column'$'\316\001' ... I ...
Gfour's user avatar
  • 1
0 votes
0 answers
139 views

How to fix deceptive site ahead warning on a wordpress site

I have an issue with my website, when visitors try to access it shows the deceptive site ahead warning I used google search console to try to fix it (as I successfully did it previously with some ...
Xsmael's user avatar
  • 103
2 votes
0 answers
80 views

How to obtain "wp_rest" nonce for WP Statistics plugin manually?

During my pentest of a client's websites I stumbled upon the WP with vulnerable WP Statistics plugin installed. To exploit this vulnerability, I should send a JSON-API request to endpoint /json-api/wp-...
skavans's user avatar
  • 121
0 votes
2 answers
220 views

What are the vulnerabilities of exposing url end point param?

I have a wordpress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public? Inside the plugin's view in WordPress dashboard....
codiMonster's user avatar
0 votes
0 answers
126 views

How to stop Wordpress search abuse? [duplicate]

My Wordpress site is experiancing high load because of large numbers of GET request like: /?s=1ce83ab566d6797d400bd3d03bb45946 How to prevent this? 17.121.115.141 - [04/May/2022:10:14:35 +0200] &...
Eraser's user avatar
  • 1
1 vote
0 answers
14 views

Wordpress: Login requests to backend from localhost [duplicate]

A Wordpress security plugin notified me about login attempts to the Wordpress login but from localhost (127.0.01). This means the requests are triggered from my root server. The attempts were trying ...
user1192748's user avatar
0 votes
0 answers
123 views

Implementing a protection for pie register vulnerability

I'm working on implementing a protection for a WordPress pie register plugin vulnerability being called: WordPress pie register 3.7.1.4 auth bypass / RCE I've conducted a research on the pie register ...
Amit Gabay's user avatar
0 votes
0 answers
140 views

Does adding a csv file to a wordpress plugin introduce security risks to the site?

I am currently working on an implementation reading data from a csv file from within a WordPress plugin. It was suggested the file be added within the plugin in an assets directory. I have concerns in ...
Moses Lara's user avatar
1 vote
1 answer
639 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
Joseph Michael's user avatar
0 votes
0 answers
46 views

WP Blog with phishing js file by a Google Search Result? [duplicate]

I wanted to check the WP homepage of a friend of mine, so I googled "rafaeltheissen be piano". The first Google result seems to point to the official page: https://rafaeltheissen.com/ Here ...
Denny Weinberg's user avatar
2 votes
0 answers
441 views

Site displaying Internal Server Error 500 just as suspicious comments flagged as spam [closed]

In my 13 years of Wordpress, I've never seen anything like this. About an hour ago I was alerted by one of my users that the website was displaying an Internal Server Error 500 message on every page. ...
robertvs's user avatar
1 vote
0 answers
205 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
ankk98's user avatar
  • 111
3 votes
0 answers
105 views

Why would a random domain point to my IP address? [duplicate]

I have a little Wordpress honeypot set up. I have it specifically set up so that when the server's IP address is accessed, the wordpress website shows up, ie. no vhost. I was reading the site's access ...
x43's user avatar
  • 203
2 votes
1 answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
Arnold Rothstein's user avatar
0 votes
0 answers
114 views

WordPress, a Security Risk for Bitcoin Application?

Asked this question on Bitcoin SE was told to post it here. I'm developing a custom Bitcoin service. Besides for the core application (which is written in PHP) I'm going to install a blog for updates ...
Design X's user avatar
0 votes
1 answer
298 views

Can't find cause of malware in Wordpress site - adding html files with redirects [closed]

I'm helping a non-profit and they have had malware on their WordPress site. I installed Sucuri and it quickly finds some strangely named HTML files in the base directory. I removed those files. ...
Arthur Frankel's user avatar
-4 votes
1 answer
580 views

Can I upload a reverse shell to a website remotely if directory listing is enabled? [closed]

Can I upload a PHP reverse shell to a WordPress website if there is a directory listing vulnerability in the website? The condition is that I can see the entire file structure of /wp-includes in a ...
Rohit Arora's user avatar
2 votes
2 answers
225 views

Unusual file permissions on WordPress websites

I've been asked by a customer of mine, to manage a few hundred WordPress sites. Doing an initial security assessment, I've found that every site (350 sites) has unusual file permissions on every php ...
Roberto Jobet's user avatar
2 votes
0 answers
417 views

Mod-security and WordPress WAF

On my WordPress websites (on LEMP stack with Nginx) I normally install a WAF plugin such as Ninja Firewall or Wordfence. I was wondering if a better practice would be to replace them with a host-based ...
Roberto Jobet's user avatar
16 votes
5 answers
5k views

Can I check the content of a suspicious file directly on the server using an editor, e.g. vim?

in the Wordpress directory I found some suspicious-looking files with random strings in their name e.g. uxs5sxp59f_index.php. Can I safely check their content ? I have a suspicion that the site has ...
nsog8sm43x's user avatar
0 votes
0 answers
191 views

Is it bad to let a file be downloaded using its direct path on WordPress?

I have a scenario that I want to let people that visit my WordPress website download some PDFs. These PDFs go to my website as products of the Woocommerce plugin, so they are stored on the folder ...
churros's user avatar
  • 153
3 votes
2 answers
874 views

What's the security risk in password recovery attempts

I'm the administrator of a Wordpress site, with just two users: me and one other user. Last days I've received multiple password recovery attempts for that other user (as an administrator I get a mail ...
Coder14's user avatar
  • 133
0 votes
1 answer
138 views

WordPress script injections [duplicate]

I manage an Ubuntu server that runs a number of WordPress sites. This morning one of them went down and was showing the exception PHP Fatal error: Namespace declaration statement has to be the very ...
PiX06's user avatar
  • 101
0 votes
2 answers
262 views

hide_my_wp wordpress plugin is activated with php eval function that might trying to read /etc/passwd? Is it true?

When I install this plugin and activate in wordpress, hide_my_wp put some eval codes in wp_options and I see the following code being injected in a new row with the ID called 76624: upload-dir=./../../...
MaXi32's user avatar
  • 137
1 vote
0 answers
228 views

Vulnerability Reporting from "random" dude

A few days ago I got an email to our dpo email address from a person I don't know who claims to be a Security Researcher. The email is well written and contains a POC with screenshots of a CORS ...
markus-tharkun's user avatar
0 votes
2 answers
327 views

UFW does not block meterpreter

I am doing some pen testing on my wordpress server. I wanted to see what would happen if the attacker were to get a hold of my username and password for wordpress. So I used the standard exploit in ...
Linux's user avatar
  • 1
0 votes
2 answers
537 views

Scanning WordPress for security vulnerabilities

I am trying to use WordPress from Azure marketplace to deploy a web app. I ran a Fortify scan on entire code base (wwwroot) which includes wp-admin, wp-includes, wp-content and other boilerplate php ...
deachyut's user avatar
1 vote
1 answer
697 views

DDoS Attack After Switching Hosts and Updating WordPress

I recently moved an old WordPress site from one hosting to Amazon Lightsail. Once the transfer was done, I noticed that WordPress, its plugins, and themes were all out of date. So, I updated them all. ...
SecurityNewbie's user avatar
1 vote
0 answers
243 views

Is using localhost for sensitive data secure?

I'm working with a nonprofit that wants to use CiviCRM to process its donor, member, and patron personal information. Civi is CMS-based, and will only run via WordPress, Drupal, Joomla, etc. Newb ...
Lynn Greene's user avatar
1 vote
2 answers
138 views

Wordpress Backups and Security

Apart from all the other security and design flaws of Wordpress, there is 1 point that particularly got my attention: "Automatic Backups". These are saved inside the Wordpress directory. If you ask ...
Asperger's user avatar
  • 145
1 vote
2 answers
157 views

Wordpress versions 5.3 and 5.4

I am testing Wordpress website that is in 5.3.3 version, which is current and updated just few days ago (April 29, 2020). But there is also 5.4 branch, is it recommended to upgrade to 5.4 because it ...
user187205's user avatar
  • 1,343
0 votes
3 answers
796 views

All 4 WP sites hosted in A2 Hosting were hacked

The hack redirects all my sites to another site All are running WP 5.4.1 (latest) and I even have a site that barely runs any plugins, just a simple open-source theme with 3 common plugins - Contact ...
cilapo1541's user avatar
1 vote
1 answer
438 views

My WP site just got hacked for the third time even after following WP hardening guidelines

After the second hack, we did all the necessary things written here - https://wordpress.org/support/article/hardening-wordpress/ , https://security.stackexchange.com/a/180925 and we also changed the ...
cilapo1541's user avatar
2 votes
1 answer
185 views

Are the developers of WordPress avoiding security by obscurity or there some reason to expose plugin and login names?

Tools like wpscan are out there in the open, which make the scanning of any WordPress website plugins without any authentication and receive sensitive data like wp-admin login names (which usually ...
Sir Muffington's user avatar
1 vote
1 answer
243 views

Can a PHP shell uploaded to a WordPress directory have access to an entire Linux machine?

I run a few WordPress instances. I had one new one that I had not configured and left sitting, so the installation was on the 1st step awaiting for the database name, username, password, and host. ...
Clark's user avatar
  • 13
0 votes
2 answers
668 views

Wordpress wp-config file seems hacked and changed to DB_NAME and DB_USER asadmin_drr and DB_HOST as 46.21.253.40 [duplicate]

I have a shared hosting on hostgator with around wordpress based websites. Out of them 4 stopped working with message as error establishing database connection. On checking the wp-config i found the ...
user avatar
1 vote
1 answer
434 views

How to identify malicious Wordpress user agents

I have noticed our website, which is Wordpress based, gets frequent daily requests from other sites where the user agent is Wordpress and the other site is obviously an already hacked Wordpress ...
BadHorsie's user avatar
  • 385
4 votes
2 answers
25k views

URL parameter manipulation and injection

I have a scenario with 2 sites. Site 1 is mysite.com and Site 2 is secondurl.com. Site 1 is using Wordpress. There, I did a Javascrit/jQuery routine that checks if a given url parameter comes in. If ...
churros's user avatar
  • 153
0 votes
0 answers
32 views

Wordpress m4shell Hack [duplicate]

I could not find any similar error after searching the web and struggling with the problem for around two weeks. One of the Wordpress sites I'm managing keeps getting hacked. There has been no ...
Vincenz Mössenböck's user avatar

1
2 3 4 5 6