WP site hacked, loaded phishing and malware through plug in

[Chips]

Had a client of ours WP site attacked. She had loaded the WP Newsman plugin and this gave access to the file structure and directories. They added a slug of links within folders. Hostgator discovered and removed a shedload of files and links. Here is what was reported to us:

We have received complaints of a phishing site being hosted on your site as referenced below. Upon inspection, we found that a phishing site had indeed been installed on your account. After further investigation, it appears that your "WP NewsMan" theme was exploited and used to place malware on the account. The theme has a file upload function which allows for new images to be uploaded however the code does not verify that the files being uploaded are actually images. This allows hackers to exploit the uploader and upload malware to the account. We recommend that you contact the developer of the theme to see if they have newer version of the theme available where this exploit is patched. Please note that if you do not update or remove this theme for all of your sites, it can lead to the account being compromised again. Simply disabling the theme will not work to resolve this issue, as the files will still be present on the account.

They noted WP NewsMan as a theme but it is a plug in, not a theme. I searched through the files and found even more newsman crud than what they found. Also, the plug in installed as a "Must Use" so you have to delete from the directory and SQL db files. It also disabled the firewall plug in so they had open access. Nasty little bugger it was, think we got it all cleared out now.

[Gamer]

Good job! Good that I do not use WP as a base for my websites.
Have heard so many horrible stories about hackers using WP plugins to attact other sites or changing affiliate links, etc. etc.
The World is crazy!

[allfreechips]

Anything you install you should know the source of where it came from! Its amazing the amount of WP attacks I see on my sites and I dont use WP!

[Chips]

Forgot to mention, the attacks appeared to come from Columbia and Peru, i.p. addresses, we blocked them in .htaccess and the ones with multiple i.p.'s were range blocked:

190.239.53.69
190.24.196.8
190.233. (multiple)
190.238. (multiple)
190.239. (multiple)

[universal4]

Thanks for the report Chips,

I will take a look at those subnets and consider blocking them globally.

The first one listed is Peru the second Columbia but the other three are India. I have a number of clients that want traffic from those countries so I will not likely block them globally. If they later become problematic for me though this will halp me decide to do so much quicker.

Rick
Universal4