WordPress Under Attack
There’s a worm on the loose and it’s attacking blogs and websites powered by WordPress.
If you are using WordPress, make sure that you are using the latest version. According to some WordPress developers, this is the only way to secure your site.
Older WordPress verions have security holes that are being actively exploited by hackers to inject spam links. You either Upgrade or Die. Not really, but your site may drop-off the search engine radar.
Matt Mullenweg (main developer of WordPress) , wrote “The only thing that I can promise will keep your blog secure today and in the future is upgrading.”
Clues That Your Site Has Been Attacked :
- Strange additions to the pretty permalink such as
/category/post-title/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_REFERER%5D))%7D%7D|.+)&%/.Check Journeyetc.com on how to fix this. - A new “admin” user has been added. Try to check your site users for “Administrator (2)”.This admin uses a javascript to hide itself. You can not even see his “presence” on your dashboard’s users page.
Steps You Need To Do
- Backup your site. Export your posts to your local drive using WordPress export tool.
- Upgrade! Upgrade! Upgrade!
- Change password.
- If your site had been attacked, read My site was hacked.
- If you need help in upgrading, just leave a comment here and BDM might be able to help you.
- If you are running a corporate site/blog and you need help right away, you may want to get in touch with WordPress Help Center.
For Advance Users
If you want to make sure that there are no extra administrators registered and hiding in your blog, you can either run this SQL query directly on your MySQL client or do it from phpMyAdmin by selecting your WordPress database as suggested by Dougal Campbell.
-
SELECT u.ID, u.user_login
-
FROM wp_users u, wp_usermeta um
-
WHERE u.ID = um.user_id
-
AND um.meta_key = ‘wp_capabilities’
-
AND um.meta_value LIKE ‘%administrator%’;
This is not to scare you but the threat is real. I’m not here like a prophet of doom, but to warn and perhaps be able to help you in any possible way I can.
17 Comments »
Leave a Reply
Recent Comments
- CorbyLove on How To Avoid Being Suspended on Twitter
- Gemma|My Dailies on How To Avoid Being Suspended on Twitter
- Jean Drei on Paypal Minimum Withdrawal Amounts
- tires on Buy 1 Year Webhosting Plan Get Another 1 Year For Free!
- brics on Best Way To Get Backlinks For Your Site or Blog
- Virtual Private Server on Buy 1 Year Webhosting Plan Get Another 1 Year For Free!
- software for invoices on Best Way To Get Backlinks For Your Site or Blog
- Elal Jane Lasola on Best Way To Get Backlinks For Your Site or Blog
- Nickson on Best Way To Get Backlinks For Your Site or Blog
- Sheen Edward on Best Way To Get Backlinks For Your Site or Blog
Premium Sponsors
Top Commentators
Blog Sponsors
Free BackLinks
Donation Only
Money Making Recommendation
Top Droppers on Entrecard
Blogroll
Friends
Archives
- May 2012
- March 2012
- February 2012
- January 2012
- December 2011
- November 2011
- October 2011
- September 2011
- August 2011
- July 2011
- June 2011
- May 2011
- April 2011
- March 2011
- February 2011
- January 2011
- December 2010
- November 2010
- October 2010
- September 2010
- August 2010
- July 2010
- June 2010
- May 2010
- April 2010
- March 2010
- February 2010
- January 2010
- December 2009
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
Jeez this is scary! I guess I need to start the upgrades now of my sites.
I was forced to upgrade too
One of my blogs was hacked before so I know how painful it is to restore a victimized site.
Uh-oh, this is scary! I’m using WordPress and I don’t know how to upgrade huhuhu. I’m still using WP 2.6, can u imagine? Mine is just a subdomain so I’m not sure if you can help me or would it just be my friend who owns the domain? The problem is, she’s no techie either.
I backed up my blog though, that’s the only thing I know how to do I guess. Any advice? I love WordPress better than Blogger so changing platform is not an option for me.
Also, I’ve been wanting to get my own domain, do you still recommend godaddy? Whenever I check out their site,I don’t know how to use the previous promo codes and I think they’re all expired by now. Shocks, please bare with my idiocy hehe.
Ooops,I meant bear, not bare. hehe sigh…
Mine is WP2.6 too until last night.
I can help you if you have the FTP details of your blog, even if it’s just a subdomain. Or just tell your friend to get in touch with me, if she wants.
btw, some promo codes are still valid
Really? Thanks Eric for your interest to help. I’ll email you about the files na lang ok? Best regards!
wow! what i hate most is the restoration because it will take a lot more time to do it than actually starting a blog!
thanks for this update
btw, i am running a contest on my blog and is currently looking for sponsors!
Thanks for the tip. I just saved a back-up in case something happen and I deleted all the peeps who subscribed. Better be safe than sorry.
kailangan na talagang mag-upgrade?
nakakatakot naman
The least that you can do is back-up your files.
it’s time like this when i am thankful for being obsessive compulsive about keeping my WP (and all it’s plugins) up-to-date. i do it THE moment i see something that needs upgrading, which irks me sometimes because i can’t help it even if i wanted to just leave it alone for a while.
btw, thanks for dropping by my site and commenting.
thanks for your tips..
This is indeed a cause for alarm. It’s one of the many reasons why I make sure that my blogs are all updated to the latest WP version.
Thanks for sharing this info especially for the detailed tips and how-to’s.
Thanks for posting about this. I read how you’ve helped Rochelle of Femmepower.
I’m going to add you to my LinkLuv page now.
To prevent this attack, if you have not done so already, update your WordPress install immediately to the latest version. Change all your passwords to a strong password, including WordPress blog access for all users, database, FTP, control panels, etc. These are all highly recommended procedures.
I also maintain several blogs to earn money online. sometimes it is hard to keep your daily earnings to stable levels..’,~
I have had a client who was hacked too. Thanks for posting this very valuable information. Although I understand why some people prefer not to upgrade because some plugins might mess up. But If it means looking for new plugins… then do it. Because its better than getting hacked.