Blackside.php Calls

That looks like “somebody” is trying to find a backdoor script that may have been dropped in WP. To answer your questions:

1. This is not related to this plugin. The directory path this plugin loads the js files from is wp-content/plugins/tinymce-advanced/.... they were looking in wp-includes/js/tinymce/... which is where the TinyMCE editor scripts are located in WP.

2. The blackside.php and wp-side.php should not exist. They afre probably names of commonly used “backdoor” scripts that may have been hidden in the above directories. That may happen when one account on a shared hosting is compromised and the attacker gains access to all “neighbor” accounts. Then they usually try to hide some sort of a backdoor so they can exploit all the rest of the accounts.

3. My guess is it gives “full access” to the server/hosting account when visiting it with a browser.

Hey Andrew,

Very much appreciate the information, even if it wasn’t plugin related.

Initially the server team said there wasn’t anything malicious and was likely something in the plugin file, which is why I reached out here.

I’ll go back to them to try and get more information.

Thanks so much!