somehow the spammers figured out a way around cleantalk’s algorithm. I’ve got 12 spam registrations already that went through today. that never happened before.
Is there something that can be done?
From: Mary Marillo
Subject: Hi Free Ajax Products Search For Woocommerce
Message Body:
If you have a woocommerce website – check this plugin and enjoy Free Ajax Products Search .
— This e-mail was sent from a contact form on ………
]]>Yes, there’s a huge security issue in your plugin code – you actually create a wonderful backdoor for spammers to ruin websites with tons of spam registrations.
The spammers don’t even need to be very smart:
1. They go to this site: https://www.getcreditcardnumbers.com/generated-credit-card-numbers (and this is just an example, I’m pretty damn sure there are tons of similar fake credit number generators)
2. They download a JSON including, let’s say, 1000 fake credit card numbers.
3. They create a macro – all this macro should do is
/ get a card number from the JSON
/ go to the targeted site
/ put a specific product to the cart
/ go to the checkout
/ fill the form with random field values (again, not so complicated to get random name, country, address, zip etc. data )
/ initiate the Stripe payment process, and use the fake credit number
4. And voila, a spam registration is done.
One of my clients has about 30000 orders and spam user accounts created this way, the amount of database trash slows down his site to such an extent that it is almost impossible to use it (backend, frontend both).
Now, this is something I couldn’t believe when identifying the method – why don’t you create the user account only upon a successful purchase?
I have some ideas why, but this is a backdoor that can’t be defended.
No anti-spam plugin or service will protect a site from this type of attack.
Please do something, and I’m very seriously asking you that do something _very urgently_!!! The fact that a WordPress site can be this easily polluted with hundreds of thousands of spam registrations in 2022 is terrifying.
Thank you,
Gabor/Lunule
If anyone has been a using a plugin on their LP website successfully, could you please provide your website URL so I/we can look at the plugin in action?
I’ve been using LP for several years now, and I’ve always disliked the way the author requires you to tick “Membership: Anyone can register” in order for a new student to purchase a course. Doing this also allows spammers to freely flood your site with spam accounts, and un-ticking the box prevents new students from signing up.
WPForms claims to be able to offer a plugin that will omit spammers, but it involves a lot of customization that may or may not work with LearnPress.
Frank
]]>I use the “allow the plugin to take care of user Login / Registration” option, and it’s letting users in that should not be allowed.
]]>