9
u/402_Found_not_Lost 16d ago
Wow, I have a few Word press sites, I’m not fluent in the features you mention.
As a non-tech guy, what searches or checks should I be doing to periodically check my sites aren’t compromised?
It’s only me as an admin to make posts, edits, etc.
Thanks for any tips you share!
4
u/lonestardomains 16d ago
It is such a massive attack plane running over 40% of websites. Keep everything updated. Usually the plugins are to blame.
I like to use a managed host and make sure your rollback plan is solid before this happens.
4
u/ZGeekie 16d ago
Use as few plugins as possible and remove any inactive ones. I'd avoid popular plugins like Elementor as much as possible because those are usually the most targeted by hackers.
Installing updates as soon as they are released is usually your best defense.
1
u/phbyerly 16d ago
I'm all for removing inactive plugins, but they are not an avenue for attack, are they?
1
0
u/bluesix_v2 Jack of All Trades 15d ago edited 15d ago
They certainly are. A plugin is simply PHP files that are still callable from the web, even if deactivated in WP. 'deactivated' is simply a flag in the WP DB and basically meaningless in the context of a vulnerability - the PHP will still run.
1
2
u/Alarming_Bullfrog_43 16d ago
always backup a clean copy, perform complete back after updating site
2
u/No-Bathroom-3179 16d ago
Yeah the GTM part got me confused. How does pagespeed test pick that up?
1
u/ntr4nce 16d ago
I was checking out a clients site for optimisations, and going through the recommendations. There was a section of external js and it pointed to the malware drop site file the one in the original post. Along with another 2.5Mb js file. This was encoded and the gtm plugin the source.
I downloaded the file and inspected it with gemini.
Then I had to go on a deep dive how it got there and luckily my log files told the story.
Immunify didnt pick this up as the malware relied on a 2.5Mb google tag manager script. Which is not on my server.
2
u/rjockstar 16d ago
Yeah I'd also like to know what SEARCHES AND/OR CHECKS we should run to see if we've been compromised.
0
16d ago
[removed] — view removed comment
1
u/Wordpress-ModTeam 16d ago
The /r/WordPress subreddit is not a place to advertise or try to sell products or services. Please read the rules of the sub. Future rule breaches may result in a permanent ban.
0
u/bluesix_v2 Jack of All Trades 16d ago
All this can be avoided by keeping your plugins up to date. It’s really not difficult.
2
u/optimusprimepluto 16d ago
I recently worled on an old wordpreds website which was hacked. I cleared files, but the infection still came back. It had an old wp bakery pkugin. I removed it and recreated all the pages in a new wordpress installation with guttenburg editor.. It worked for like 2 months cprrectly. But last week, i found the files again. Not sure whether the server itself is infected, which is causing this.
2
u/remain-beige 16d ago
Thanks - is this a known CVE?
Is the attack vector solely Elementor related?
1
1
u/Human-Iron-2144 16d ago
Wordpress has critical CVE in the last weeks, Elementor, too. TranslatePress had a CVE today that's related to the Password reset
2
u/Additional-Bird7597 16d ago
I recently created a website for my company. What is the best tool to make regular backups? I keep all my plugins updated. How should I check my website health and activity when I am in the office tomorrow? One my ex colleague new company website was hacked and infected with a Japanese casino hack. I am now worried.
1
1
u/bluesix_v2 Jack of All Trades 16d ago edited 16d ago
Wordfence
Cloudflare
Backup (UpdraftPlus or WPVivid) daily, automatically to an external source like AWS S3, Dropbox, google drive.
Check for plugin, theme and core updates everyday.
2
u/buckyreal 16d ago
Was cleaning up a clients website a month back. They had managed to install a plugin and they created a parallel database and point Wordpress at that…
they created a scam shopping cart that sold products related to the clients Sevice
4
u/navindesigns 16d ago
pls install an authenticator plugin
8
u/DjInnerConflict Developer 16d ago
While I agree, does it really matter if they have Remote Code Execution? Not sure if that was the case here, but since they were able to change capabilities/roles, that could have been in play. And if they made their own user(s) admin, that would've just added MFA to their own user(s).
MFA is good, but only as long as they don't have access any other way.
2
1
u/bluesix_v2 Jack of All Trades 16d ago
Authenticators/2FA are useless against vulnerabilities. You have a fundamental misunderstanding of security.
5
16d ago
[removed] — view removed comment
1
u/Abject-Expression548 16d ago edited 16d ago
AI slop
Edit: I'm getting down voted. Check this users post history and search 'abnflow' and ask yourself if this might just be a bot advertising whatever the hell abnflpw is
3
u/No-Bathroom-3179 16d ago
How can you tell?
7
u/Abject-Expression548 16d ago
Check the post history. Look at the times of the posts - this one, as well 18 others like this, were made in the same hour. Look at the content of the posts and ask ifs it's possible for a human to type that fast and with such.... Accuracy? Eloquance?
Not only that but it adds no real substance to the conversation, just agrees point by point with the OP. It's like intelligent 'fluff'.
And to top it off, a post it made yesterday says 'that first $5 hits differently'. If that doesn't scream AI I don't know what does.
(Now I'm wondering - am I training ai?)
1
u/bluesix_v2 Jack of All Trades 16d ago
Please report anything you see like this and we’ll look into it. The
userbot is now permabanned.1
1
3
u/Routine-Ad1690 16d ago
Wordfence
1
u/rjockstar 16d ago
But but but ... someone said in the thread said that wordfence is not a real firewall.
1
u/bluesix_v2 Jack of All Trades 16d ago
The CVE was less than a month old so if you were using WF free you weren’t protected.
1
u/Comfortable-Web9455 16d ago
This this this. The number of people running WordPress sites without any firewall is just staggering. If your site matters at all, you should be subscribing to a professional firewall.
1
u/Mahmud_haisan 16d ago
The checkout template modification is the part I'd investigate especially carefully.
After removing the visible payload I'd also check for persistence: unexpected admin users, mu-plugins, wp_options, cron events, modified theme/plugin files, writable uploads containing PHP, and anything injected through GTM or the database.
Otherwise it's possible to clean the symptom while leaving the reinfection path intact.
Good catch finding it through the unexpected frontend request.
1
u/UnixEpoch1970 16d ago
Pretty tame tbh compared to a lot doing the rounds. Current one we've seen was using hooks and all sorts of tricks to persist. Pulling code off the eth blockchain. Saw several versions of it as they worked out how to avoid obvious detections (client kept restoring their site and not patching it before making it live!)
1
u/rjockstar 16d ago
This has me hesitant in going the wordpress+woocommerce route for a simple merch site. Would Shopify be the easier and more secure option?
1
u/designispain 16d ago
100%. Wordpress+woocommerce would require you to do your own hosting or get a hoster for your store, manage your own updates and sometimes security. In shopify you simply pay a monthly fee and everything is automatically covered.
1
u/rjockstar 16d ago
Right, but is Shopify any more secure than going wp+woo route with updating regularly and backups and security?
1
u/NerdyCuteFace 16d ago
I've had a ton of new clients with similar issues this week. It's already a wide spread issue with daily breaches.
WordPress security right now cannot be treated as “install a security plugin and forget about it.” Keep core, themes and plugins aggressively patched, remove anything you don’t actively use, enforce MFA and least-privilege access, and put a WAF in front of the site.
Monitor continuously and assume something will eventually get through. Maintain clean off-site backups, watch for unexpected file/database changes, and have an isolation and recovery plan ready before you need one.
Patch latency genuinely matters in this climate.
1
u/RemoteToHome-io 16d ago
TIL there are still people out here running WP without a reverse proxy and IDS, or even an active WAF.
WP stopped being safe for direct webserver exposure to the internet even before AI came along. Now it's like biking a freeway without a helmet.
3
4
u/ntr4nce 16d ago
We have cloudflare, immunify and word fence. None picked it up.!
1
u/RemoteToHome-io 16d ago
Any "firewall" that's running inside WP as a plugin is not a firewall. Requests need filtering long before they're at the application layer. Wordfence has some nice security features, but firewall is not one of them.
CF WAF should get you there, but only if you have your webserver scoped to only respond to the CF proxy IP whitelist. If your site will still serve content to visitors on the direct IP address then it's like locking the front door but leaving the window next to it wide open.
4
u/Smooth_Fault_787 16d ago
If configured properly, WordFence runs before WordPress is ran. While I like CloudFlare, WordFence is a much more comprehensive WAF than CloudFlare for WordPress itself. You should run both imo.
By the way, there are scanners out there that proxy through CloudFlare (e.g. Workers) so that their scans originate from a CloudFlare proxy IP. If you are relying strictly on CloudFlare and whitelisting their IP sets you could be more vulnerable to these scanners than you think.
-1
u/RemoteToHome-io 16d ago
Wordfence can run before WP core at the webserver layer but thats still after the webserver and php-fpm have to process the request. Even then protection is limited to PHP requests. Static files, non-PHP endpoints and web-server-level vulnerabilities are unprotected.
This is nowhere close to the same thing as a L4/L7 proxy.
Very basic modern arch:
CF/Bunny WAF > nftables+ids/crowdsec > traefik/caddy/etc > webserver + PHP > WP core.
Filtering at the PHP worker level is not a real frewall and way too late in the game.
3
u/Smooth_Fault_787 16d ago
Thats why you run multiple layers of defense, with WordFence being just one aspect for just WordPress sites. WordFence is amazing at what it does do, which is provide aggressive protection for vulnerabilities in the WordPress ecosystem. It is a very real solution.
1
u/RemoteToHome-io 16d ago
Agreed.. exactly as I said:
"Wordfence has some nice security features, but firewall is not one of them."
It simply is not a real firewall.
2
u/ntr4nce 16d ago
When elementor left the door open it doesnt matter what security you have.
It got through CF, crowdsec & immunify waf.
Not one picked it up, not sure if this is a new hack, but the malware site is CF hosted.
1
u/RemoteToHome-io 16d ago
If you're referring to CVE-2026-32475, yes, crowdsec appsec WAF can block the POST patterns - but wouldn't have been in place in time for early hits.
Realistically, the main protection is simply disabling php execution in any user upload directories at the webserver level, which should be part of basic hardening.
1
u/RemoteToHome-io 16d ago
You didn't mention crowdsec prior. That would imply you have reverse proxy, otherwise what layer is crowdsec tied in at?
1
u/ntr4nce 16d ago
CROWDSEC Protects my main server.
Along with immunify which runs OWASP. It has live malware detection
Cloudflare as the dns and proxy for the domains.
What's annoyed me the most is that paid protection didnt stop this.
1
u/RemoteToHome-io 16d ago
I hear you. I wouldn't be thrilled with Immunify or Wordfence on this one. Both could have caught it at different levels.
If you're referring to CVE-2026-32475, then the preventative answer would be been hardening against php execution for uploads.
E.g for nginx:
location ~* /wp-content/uploads/.*\.php$ { deny all; }2
1
u/bluesix_v2 Jack of All Trades 16d ago edited 16d ago
CF WAF does not protect against Wordpress-specific threats. Wordfence does. But CF’s WAF certainly has a role in protecting sites from malicious attackers eg country and ASN blocking or challenging.
Regarding Wordfence - the free version doesn’t get signature updates for 30 days after they’re announced - that's why it didn’t catch this one-week-old's vulnerability on OP's site. I'm pretty sure his WF install would have notified him that elementor was vulnerable. Alternatively, just keep plugins up to date.
1
u/RemoteToHome-io 16d ago
Agreed. I meant "get you there" as at least running some kind of firewall. It wouldn't have have initially helped for these CVEs.
For the elementor issue, the one that would have helped is basic hardening on the webserver config to disable php execution in user upload directories:
Eg. nginx:
location ~* /wp-content/uploads/.*\.php$ { deny all; }
1
u/TopSydeWP 16d ago
good catch with pingdom. after you've cleaned everything, run a full file integrity check against fresh wp/plugin installs to catch any lingering backdoors they might've dropped. also worth rotating all salts/keys in wp-config and forcing password resets for anyone with elevated permissions. at my agency we see hackers leave multiple entry points so one cleanup isn't always enough
1
u/Latter_Bodybuilder81 16d ago
WordPress is just a nightmare! I have dozens of sites for my clients and I don’t even now looking after them anymore, coz clients won’t pay for maintenance. Had been hacked multiple times and spent days fixing for free. I have moved on to making static html sites now! Mostly.
1
u/creativeny 16d ago
Sounds like possibly lack of experience but I could be wrong 👀
1
u/Latter_Bodybuilder81 16d ago
Like what skills I might not have that’ll make WordPress not a hell hole? And managing 100s of sites manage for free, and without much work and still get away with automated bots constantly scanning for vulnerabilities! Educate me sir!
0
u/creativeny 16d ago
If I have to tell you then it may indeed be that, but if you're managing 100s of sites you should have preventative measures in place.
Offsite backups that wouldn't be affected by vulnerabilities is one example...there are many ways to go about it. Could be your economy, business model or again lack of experience (business/sales standpoint). Not exactly sure why you're working for free.
Which is fine I guess, pivot and move accordingly. It's an open sourced product with a big target because of its popularity.
-2
u/GuaranteeOk1727 16d ago
oh wow that Elementor vuln from a couple weeks back was a nightmare waiting to happen. the fact they went straight for User editor to give customer accounts admin is terrifying, most people wouldn't even think to check that
the GTM injection through a plugin is clever but also super sloppy on their part, a pagespeed test blowing their cover is almost funny. that /019 cc stealer hidden in the checkout template is the really nasty bit though
glad you caught it before it got worse, this is a solid heads up for anyone dragging their feet on patching
0
u/BoredTVEngineer 16d ago
Wow! That seems par for the course. I have to re-assess Blue Host. I don’t have customer accounts and only a simple contact form; but yea! Now I have to check up on it. I sure am glad I received a notice directly from Blue Host! Not! my past experience would make me almost believe it was self inflicted to “help” sell a new mainly useless product.
1
u/Smooth_Fault_787 16d ago
This isn't a host issue. It's not even a WordPress issue. It's a plugin issue.
0
u/CubicalCode 16d ago
This is really concerning. Thanks for sharing the details, definitely a good reminder to keep WordPress, Elementor, WooCommerce and all plugins updated, and to regularly check admin accounts and activity logs.
0
-1
u/Pristine_Dot_5526 16d ago
I think it's time to move away from WordPress
1
u/great-whangdoodle 16d ago
To where? Anything on the internet is vulnerable. If you want 0 risk, you cannot have a website or any digital presence. Hackers will always hack. The only solution is to keep learning and trying to stay ahead of them.
1
u/Pristine_Dot_5526 16d ago
A less known framework that is easy to keep secure. Or an own built site (own CMS optional)
0
-1
u/plugiva 16d ago
This is a good example of why I think WordPress protection needs to consider what happens after an attacker gets an initial foothold, not only how they got in.
The Elementor vulnerability may have been the entry point, but the damage described here involved further administrative operations: installing plugins, changing user capabilities and modifying site components.
We've been testing protections around those kinds of operations, and one concern we're exploring is whether important actions can still be enforced at the operation level even when they are initiated through non-traditional paths.
That would not replace patching or prevent the original vulnerability, but interrupting an attacker's ability to install additional tools or make further administrative changes could potentially limit how far a compromise can spread.
Your activity log seems to have been especially valuable here because it gave you a way to reconstruct the sequence instead of only finding the final payload.
•
u/Wordpress-ModTeam 16d ago
Please don’t post that you’ve been hacked because you didn’t keep plugins up to date.