WP site hacked, loaded phishing and malware through plug in
Had a client of ours WP site attacked. She had loaded the WP Newsman plugin and this gave access to the file structure and directories. They added a slug of links within folders. Hostgator discovered and removed a shedload of files and links. Here is what was reported to us:
Quote:
We have received complaints of a phishing site being hosted on your site as referenced below. Upon inspection, we found that a phishing site had indeed been installed on your account. After further investigation, it appears that your "WP NewsMan" theme was exploited and used to place malware on the account. The theme has a file upload function which allows for new images to be uploaded however the code does not verify that the files being uploaded are actually images. This allows hackers to exploit the uploader and upload malware to the account. We recommend that you contact the developer of the theme to see if they have newer version of the theme available where this exploit is patched. Please note that if you do not update or remove this theme for all of your sites, it can lead to the account being compromised again. Simply disabling the theme will not work to resolve this issue, as the files will still be present on the account.
They noted WP NewsMan as a theme but it is a plug in, not a theme. I searched through the files and found even more newsman crud than what they found. Also, the plug in installed as a "Must Use" so you have to delete from the directory and SQL db files. It also disabled the firewall plug in so they had open access. Nasty little bugger it was, think we got it all cleared out now.
