Plugin exploited?

Hi, I haven’t heard of this happening to anyone else, it’s possible that someone was trying to log into your site at the same time as you and locked you out.

Was the error “update failed” or another error? What did you have in the IP field?

Thanks.

The IP field was my own IP address. I just have decided to take the plugin off the sites I installed it on, as wordfence helps me track potential hackers/bots. It happened on another website of mine a few days ago where I was locked out by someone attempting to bruteforce the admin (which on that site I do not have have a user with admin as I used a different login).

The error just said update failed when I input my ip address on the settings page. I had deactivated the plugin, and reactivated it, and then tried the settings page but that is what happened so I rendered it not usable for the time being.

If there is anything you’d like me to do or provide, then let me know, unless it’s just user error not knowing that it locks out everyone from accessing the site when a bot or person tries logging in with a useless bruteforce attack.

It does indeed block everyone from logging in (to prevent distributed botnet attacks that come from hundreds of different IPs at the same time) irrelevant of usernames or IPs – it sounds like that’s not what you were expecting it to do!

However, you still should’ve been able to update the settings in the database. It’s very standard WP code to create and update the settings and I can’t recreate your issue at all. I’ll keep trying ??

What happened was I had gotten blocked, then I had simply removed the plugin off the server via FTP. Then I was able to log back into wordpress, reinstall the plugin. Went to settings page, put my ip address in, clicked update and then it gave me the error I mentioned.

When I get the time I’ll try it out again, however are there any tables in the database that I can try to remove completely to start fresh? Have not checked to see what it may be called as I was going to wipe it.

In the wordpress options table (usually wp_options) there’s a field created called bab_options which contains the array of settings. Sounds like it may have prevented the update as you were locked out at the time – I’d have to check the code.

Yeah your plugin doesn’t have a way to uninstall any table settings. That might help for those that uninstall or have issues.

Thanks, I’ll add that to the roadmap.