Wordpress users please read

SecNam · 05-09-2009, 11:41:53 PM

WordPress › Blog How to Keep WordPress Secure

Skinner · 06-09-2009, 12:02:15 AM

If you have 2.8.4 your clear, and you can check if your clean by looking at the permalinks menu if anything funky has happened.

Specifically look for eval and base64_decode in there, which is the method of injection.

You can also look for a consealed admin too, you will probably need to disable javascript to tell, so firefox or opera are your friend.

If your infected, its going to be a long long night, as its infection has spread into the database, so upgrading WONT fix it.

**edited now I'm on my PC**

Systreg · 06-09-2009, 12:11:13 AM

Another link about this that someone posted on twitter earlier: Old WordPress Versions Under Attack Lorelle on WordPress

Alien · 06-09-2009, 09:24:10 AM

Thanks for the heads up; only got one site on WP, which I've now updated to latest version (I just love the auto update feature via FTP in the Control Panel, so easy!).

bensd · 06-09-2009, 09:31:17 AM

Quote:

Originally Posted by Alien

Thanks for the heads up; only got one site on WP, which I've now updated to latest version (I just love the auto update feature via FTP in the Control Panel, so easy!).

It is much better, you can also now browse and upload new themes through the control panel.

WARNING - IF YOU HAVE AMENDED ONE OF THE DEFAULT TEMPLATES.
If you have amended one of the deafult templates this will be overwritten when you do an auto upgrade.

05-09-2009, 11:41:53 PM	#1 (permalink)
SecNam Join Date: Jul 2004 Posts: 4,139 Classified Rating: 100% (1) Domain Trader Rating: (100% / 44)	Wordpress users please read WordPress › Blog How to Keep WordPress Secure

06-09-2009, 12:02:15 AM	#2 (permalink)
Skinner Join Date: Jul 2008 Location: Manchester Posts: 2,501 No Classified Ratings Domain Trader Rating: (100% / 13)	If you have 2.8.4 your clear, and you can check if your clean by looking at the permalinks menu if anything funky has happened. Specifically look for eval and base64_decode in there, which is the method of injection. You can also look for a consealed admin too, you will probably need to disable javascript to tell, so firefox or opera are your friend. If your infected, its going to be a long long night, as its infection has spread into the database, so upgrading WONT fix it. edited now I'm on my PC __________________ Browse: Last edited by Skinner; 06-09-2009 at 12:12:28 AM.

06-09-2009, 09:24:10 AM	#4 (permalink)
Alien Join Date: May 2006 Location: Alienesque City Posts: 4,210 No Classified Ratings Domain Trader Rating: (100% / 51)	Thanks for the heads up; only got one site on WP, which I've now updated to latest version (I just love the auto update feature via FTP in the Control Panel, so easy!). __________________ UK Content Writing from Wait.co.uk \| Follow me@Twitter! \| HighHedges.com (developed site), only �300! \| Buy a customised Fresh Store Builder site to develop your unused domain(s)!

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Domain Name Community	Replies	Last Post
Example of sites built in Wordpress	WaftyCrank	Wordpress	13	18-03-2009 07:53:02 PM
Free Wordpress Theme Gallery - Submit YOUR theme!	bizcorp	Domain Appraisals	2	20-02-2009 03:42:46 AM
Cpanel Advice: Please Read! SPAM IN YOUR EMAILS!	Billy	Hosting	3	27-07-2008 12:32:27 PM
Wordpress themes !! PLEASE READ !!	SecNam	Wordpress	0	11-02-2008 09:37:27 AM
Chinese Web users lose 10000 domain names in quakes - Legit Reviews	RSS	Domain Name News	0	05-01-2007 02:59:03 PM

06-09-2009, 12:11:13 AM	#3 (permalink)
Systreg Join Date: Oct 2008 Location: County Cork Republic of Ireland Posts: 3,906 No Classified Ratings Domain Trader Rating: (100% / 104)	Another link about this that someone posted on twitter earlier: Old WordPress Versions Under Attack Lorelle on WordPress