8 popular wp plugins hacked and exploited

[Colmike7]

Looks like there is an ongoing hacking campaign. Several attempts of File Upload in file: upload=x.php and admin.php were blocked on the 7th, 12 and 13th of September on almost all of my sites (both porn and non-porn).

File uploads are pretty common for uploading and running shells. Like, if a site has an upload feature but doesn't validate the file types correctly, I could have full access to everything very easily using one php file, assuming that I know the path to where the uploads are going.. : x

[Colmike7]

You can also bypass the MIME check with special proxy/burp tools to spoof the content-type header if they do have the right validation. Coding things yourself, especially things that don't need to be updated ever, is the best way to go if you want to do the extra learning and work.

[LustCore]

Typical automated attack, when the attackers are looking for outdated, vulnerable websites. Happens that you will not notice anything, just that you are silently became a backlink site for others.

[Colmike7]

Typical automated attack, when the attackers are looking for outdated, vulnerable websites. Happens that you will not notice anything, just that you are silently became a backlink site for others.

Oh yeah, that's been going on since forever. They'll just look up info on some old vulnerabilities and find the ones that didn't update/fix it. :p

[AlexO]

Typical automated attack, when the attackers are looking for outdated, vulnerable websites. Happens that you will not notice anything, just that you are silently became a backlink site for others.

Oh yeah, that's been going on since forever. They'll just look up info on some old vulnerabilities and find the ones that didn't update/fix it. :p

Best to keep plugins updated to the latest version, reduce your exposure to hackers.

My 2 cents on updates.

[bbwlover]

Less is best when it comes to adding plugins, add what you rally need and use.

Good way to out it.

[yobilinks]

what else is vulnerable and we should know of?

[LustCore]

what else is vulnerable and we should know of?

Short answer is everything. Difference is the level of vulnerability. You know, even a condom can fail...

[wetnwild]

what else is vulnerable and we should know of?

Short answer is everything. Difference is the level of vulnerability. You know, even a condom can fail...

Very well put hon

[rx_tom]

what else is vulnerable and we should know of?

Short answer is everything. Difference is the level of vulnerability. You know, even a condom can fail...

Keep plugins at a minimum is what I say and do, unless necessary screw adding more.

[LustCore]

And remove the ones that you are not using, including themes

[vblogger]

keep this on page one

[TightAss]

keep this on page one

Only if there are more plugins to be on the look out that can be a problem