Questions tagged [wordpress]

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

Filter by
Sorted by
Tagged with
0
votes
1answer
596 views

Pentest a WordPress installation

I will help a friend to test the security behind their WordPress site. I thought about to start to do a scan with Burpsuite and also WPScan, I also believe I will find a acunetix useful. When I read ...
3
votes
1answer
228 views

How to set basic defense on Nginx-CMS?

As an Information Security amateur I did all in my might to protect my Ubuntu-Nginx-CMS (WordPress) environment from BFAs, MITMs, and database injections. sudo add-apt-repository ppa:certbot/certbot -...
5
votes
1answer
5k views

How does this Wordpress site got infected with vlomaw.zip, tondjr.zip, oniyur.zip

I would like to know if anyone knows where does this attack came from? One of our customer's sites was infected by a code which generated several files like: 0b37a.php.suspected 5394bb9efbe.php ...
0
votes
1answer
381 views

PHP Backdoor on live server [duplicate]

Suddenly one of our Wordpress websites started sending spam emails and it was blacklisted on MXToolBox. So with the server support I scaned the files and found a strange file called timer.php ...
5
votes
3answers
2k views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
3
votes
1answer
141 views

Q: Need help understanding hacked site that only impacts AT&T LTE users

I'm almost certain my (new) client's wordpress site is hacked. The home page is fine, but every subdirectory on the page loads with very sketchy content seemingly injected into the page. But here's ...
2
votes
1answer
392 views

How does this backdoor work?

I just found that one of my wordpress websites included backdoor (my guess). As I see now, the same file on server is different than original on my laptop drive. So I think my website is already ...
4
votes
2answers
1k views

What is the best way to prevent code injection in Apache/PHP?

I have recently setup wordpress on a VPS, and it is under continuous attack since. I have taken some measures to protect from some bruteforce attacks, however looking at some of the logs I am not sure ...
1
vote
1answer
122 views

How to interpret SELinux boolean allow rules?

I'm trying to understand what permissions are allowed by some of the SELinux booleans for httpd domain, as it is my main source of concern, and the current policy of my organization is to give truly ...
1
vote
0answers
317 views

Zed Attack Proxy Fuzzer cookie handling

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not ...
1
vote
0answers
897 views

php-reverse-shell in Wordpress can't connect to netcat

I am accessing an intentionally vulnerable VM hosting an older version of Wordpress. I have admin access to the Wordpress site and have been trying to use pentestmonkey's php-reverse-shell script to ...
1
vote
2answers
309 views

Wordpress 4.7.6 vulnerabilities? [closed]

I have a wordpress 4.7.6 without plugins, however, I've noticed this: https://cxsecurity.com/cveshow/CVE-2017-14723 And the other vulnerabilities that are <4.8.2. My question is, I have tried to ...
5
votes
1answer
423 views

Why is Google using Local File Inclusion and Directory Traversal attempts on my site

If have a firewall on my wordpress site and it has blocked Google from attempting both Local File Inclusion and Directory Traversal attempts. Why would Google be doing this? United States Mountain ...
1
vote
1answer
305 views

Wordpress site hack attempt

I found some thing upnormal in my nginx server log. 74.208.235.132 - - [06/Oct/2017:03:36:20 +0000] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%...
13
votes
3answers
4k views

Bank of America phishing site

A text message was sent to my phone stating that my Bank of America account had been suspended due to suspicious activity. It then provided a link to reactivate it. Obvious phishing scam. The URL they ...
6
votes
1answer
796 views

What is this script attempting to do? [closed]

I have just been given access to a site to maintain, so the first thing I thought I'd do is some updates. After checking Wordfence it complained about a script which contained a file with the ...
1
vote
1answer
187 views

Is this input field and function secure? [closed]

Im just learning about IT security, so this is basic stuff and Im maybe overthinking it. 1. I have this input field on my wordpress site (ssl is on) that directs the user to the product he typed in: ...
0
votes
1answer
484 views

WordPress 4.7.2 Authentication Cookie Brute-force

I recently came across a WordPress (v 4.7.2) site with an exposed wp-config.php file, within which plain text server authorisation key secrets were accessible. Having read Mike Czumak's article on ...
0
votes
1answer
120 views

Can I create a website on wordpress anonymously? [duplicate]

If I use a VPN that doesn't keep logs and create an email account, then use that email account to create a wordpress website (still using the VPN) and give no personal information (address, name, etc.)...
2
votes
3answers
2k views

Huge amount of hidden porn backlinks from legit WordPress sites, why they did it?

I was doing some backlink research and found a huge amount of legit websites linking to the site I was researching. The problem was that the anchor text of all the links where porn related terms.... ...
0
votes
1answer
140 views

How to check who uploaded malware [duplicate]

My website has been hacked or attempted to be hack. I can see malicious uploaded files on my website server is there any way I can reveal the IP address of who has uploaded the file? Also my website ...
6
votes
2answers
6k views

What are sensitive Wordpress site directories

I'm penetration testing a website for a friend. It runs on WP and has directory indexing enabled. I would like to provide a PoC of why this is an issue, but I've never used Wordpress so I don't know ...
3
votes
1answer
1k views

Wordpress 4.0 CSRF Password Reset

I am working on a faculty project. I need to replicate Wordpress CSRF vulnerability on my localhost wordpress. I am trying to do this: https://wpvulndb.com/vulnerabilities/7691 I couldn't find any ...
0
votes
2answers
2k views

Wordpress - blocked by firewall for Malicious File Upload

Our work website is getting flooded with these types of hacks: The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running ...
0
votes
1answer
106 views

Is SFTP going to improve Wordpress security?

Disclosure: I am a developer and not a security expert I am working on a Wordpress site for a client who is (understandably) concerned about WP security. The client will be hosting the site on their ...
3
votes
1answer
3k views

Metasploit. Is always replacing domain names with resolved ips on RHOST/RHOSTS?

There is a website which I want to audit. That site must have a concrete Virtualhost configuration because if you access to it using the domain name the website is shown, but if you use the ip address ...
0
votes
1answer
384 views

Google's view of a web page is corrupted

Recently, one of my website has been hacked in a very interesting way. By doing some researches I've found that I wasn't the only one affected by the hack, but didn't find anything about it. Note : ...
1
vote
1answer
77 views

Is it possible or common for a website (without ads) to only sometimes do a malicious redirect?

Using Chrome, I went to a website of a company we were researching, following a link from a google search, and got redirected to a malicious website. After killing Chrome and scanning for viruses, I ...
1
vote
1answer
278 views

What is the Point of Spam Registrations on New Wordpress Site?

I asked this over in the Wordpress Developers site and no one had a clue. There was a suggestion I should ask here. So, I know why spammers create posts with links on Wordpress sites--they do it for ...
1
vote
4answers
3k views

Can a Wordpress be hacked by accessing a PHP script on the same server?

Our Wordpress website was hacked. I couldn't find anything intelligible from my limited experience from the limited logs my hosting gives. However, browsing in the FTP files I found a post.php file in ...
3
votes
3answers
571 views

Will PHP malware from my hacked website be able to infect my computer locally if downloaded?

I have site that is hacked and flagged by Google for having malware: Some pages on this website send visitors to the following dangerous websites: freshmodel.pw. I made a backup of everything ...
0
votes
3answers
324 views

Constant hack attempts for the past 2 days

I notice an increase in my cpu for the last two days so I looked at my access_log and I have been constantly pinged by the ip 46.183.120.20. 46.183.120.20 - - [14/Mar/2017:14:11:46 +0000] "POST /wp-...
6
votes
1answer
767 views

Cookie that contains NULL byte character (0x00) on new WordPress.org site - any issues?

I installed NinjaFirewall plugin on WP.org v4.7.2. It locked me out of my site. They asked for the log from my hosting company's cPanel, which I got and they report: You have a cookie that ...
2
votes
1answer
488 views

Displaying list of registered users on a website

I've just started working for a small company that has a Wordpress website with user accounts. Each user account has a login name, display name, actual name, email, password and the rest. I dug down ...
1
vote
1answer
2k views

Should I be concerned about the WordPress REST API's user enumeration vulnerability?

With the current WordPress API you can get a list of usernames and email addresses of all users in the system with almost no effort: <url>/wp-json/wp/v2/users Outputs something like: [{ "...
1
vote
1answer
82 views

SSO Understainding Credentials and Authentication [closed]

I would like to create a SSO where my users can login to machines and wordpress (php) websites. So far I have LDAP with Kerberos working. I can login with the same credentials to every service, ...
1
vote
1answer
386 views

Email is marked as spam by Google [closed]

Okay this is strange, I was working with WP_Mail() function, and it's been called successfully from the following statement, and email was delivered correctly. if ($temp == 'offline-payment') { $...
5
votes
2answers
5k views

Malicious code is injected to a PHP file [duplicate]

My site is built using Wordpress. One day it stopped working and found an error in one PHP file. When I downloaded that PHP file to see what happened, my antivirus (Microsoft Security Essentials) ...
5
votes
1answer
2k views

Does Wordpress REST API with CORS enabled represent a security risk?

After a security inspection of a site running Wordpress with a REST API, the scanner flagged the route /wp-json/ as a vulnerability due to a very flexible CORS policy that allows third parties to ...
1
vote
0answers
152 views

Wordpress site hacked [duplicate]

I have a client with his wordpress site hacked. The hackers added new folder and files and changed the index.php. I would like to know if when this happens, Could the hacker add also malicious code ...
1
vote
0answers
47 views

WordPress site sends email from strange domains

I had a WordPress site with a security plugin configured to send me periodical database backups via email. This morning I noticed that I was receiving these emails as coming from two strange domains I ...
0
votes
3answers
190 views

Shared hosting— whose responsibility is dealing with known vulnerabilities?

I've deployed a few dozen Wordpress sites over the last 10 years across a variety of hosts. I have a single client on a particular host I've never used before whose Wordpress site has been hacked ...
9
votes
5answers
7k views

How can a PHP file be added over and over to my hacked site?

I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
1
vote
1answer
115 views

PCI DSS - one server one primary function (different database engines)

I looked at a few other questions similar to mine but they all talk about web/email/database on the same server. My question is a bit different. My business uses SQL Server 2008 as its backbone and ....
3
votes
2answers
53 views

Setting up a Wordpress blog on another server pointing to a subdomain for security purposes

I have an ecommerce site with thousands of customers registered. We wish to set up a Wordpress blog on this ecommerce domain name but wish to host the blog elsewhere for added security. After reading ...
2
votes
2answers
379 views

Under xmlrpc attack, what is the best approach?

I'm running a php application on a VPS. Recently I started a blog for my app on the same server, using wordpress and nginx. Everything was running fine, until today server was returning error 502 ...
3
votes
2answers
1k views

How to prevent malicious file uploads to a site

Recently a couple of sites we had built have been used to send a tonne of spam emails. We aren't security experts, but with some research believe that it may be some kind of PHP Injection taking place....
0
votes
2answers
2k views

How to completely hide wordpress version number [closed]

Is there a way to completely hide WordPress version number? I tried a couple of tricks like: hiding version from meta-generator and from CSS by adding the following lines in functions.php of the ...
-3
votes
2answers
111 views

How high is the security risk if a hacker got your wordpress wp-config.php file and a dump of your database?

If a hacker got a hold of your wordpress wp-config.php file and a dump of your database containing your hashed password? How hard would it take for them to easily cracked your password even if you are ...
1
vote
0answers
147 views

Obfuscated PHP code found in WordPress core files and plugins [duplicate]

I am running a Wordpress website and I've recently found this php code injected in many of my php files. https://www.unphp.net/decode/fb4715ee71b28135f6807389df42611c/ I tried adding some print_r(...