Jili hilo download,Game Vault.Recharge Every day and Get Bonus up-to 50%!

Reply To: New User created | Blog got hacked

Steven Stern (sterndata) — Thu, 08 Nov 2018 22:03:37 +0000

This is likely due to a problem with a particular plugin. See https://www.wordfence.com/blog/2018/11/privilege-escalation-flaw-in-wp-gdpr-compliance-plugin-exploited-in-the-wild/

Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

Reply To: New User created | Blog got hacked

jeanneer — Thu, 08 Nov 2018 22:07:31 +0000

Thank you.

However I haven’t updated the site in nearly a month and also didn’t installed any new plugins. So I’m not really sure how a plugin can cause this problem :/

Reply To: New User created | Blog got hacked

Steven Stern (sterndata) — Thu, 08 Nov 2018 22:23:58 +0000

if you were using that plugin, you were vulnerable.

Reply To: New User created | Blog got hacked

robfaulk3 — Thu, 08 Nov 2018 23:24:30 +0000

Hi,

We have had the same thing happen to us today. I noticed two new users ‘t2trollherten’ & ‘t3trollherten’ created accounts a few hours ago. I was suspicious but thought “People have weird email addresses these days” and put no pass on it as we have good security measures in place. A few minutes ago we received an email stating that one of the above users updated their passwords. This made me more suspicious, which lead me to then search the username to find this post.

We have deleted both users, the GDPR Compliance plugin and are now following Stevens advice above.

I will keep you posted on the outcome

Thanks for creating this post and thanks for the advice Steven!

Robert

Reply To: New User created | Blog got hacked

zgrimv — Fri, 09 Nov 2018 00:00:45 +0000

Hi,

I have the same issue with being hacked via t2trollherten who created a user account then changed their password even though new users were disabled. I did have the GDPR plugin installed. My site is totally messed up now and when I navigate to my page and admin login I can the below

Parse error: syntax error, unexpected ‘text’ (T_STRING) in /mounted-storage/home5/sub033/sc87784-VPMR/dirtyvortex.net/wp-includes/class-oembed.php on line 461

I’ve locked my site via web host control panel and checked the folder name of the site on the server. How can I go about resolving this hack? Is it even possible?

Reply To: New User created | Blog got hacked

rivmedia — Fri, 09 Nov 2018 00:12:09 +0000

We’ve cleaned up a few sites today, same users being used. They are also injecting a backdoor/file into the uploads folder.

Check the databases for hidden admin users which do not show up in the WP admin.

The WP GDPR compliance plugin is the cause.

Reply To: New User created | Blog got hacked

lavizh — Fri, 09 Nov 2018 00:13:45 +0000

which file is being injected into the uploads folder? i can’t access my site at all after this hack How do i get it back? I can’t access my admin panel at all.

Reply To: New User created | Blog got hacked

zgrimv — Fri, 09 Nov 2018 00:34:49 +0000

OK, I seemed to have resolved the hack by replacing all files that the hacker messed around with and removing the new user they managed to create via my hosting control panel. Site is back up and running.

Reply To: New User created | Blog got hacked

elldo — Fri, 09 Nov 2018 00:49:26 +0000

We have just found the same hack by “t2trollherten” has happened to us. We have deleted the user, checked to see any files were recently modified on the server (they were not) and deleted the vulnerable plugins (GDPR Compliance & Contact Form 7).

Feeling understandably concerned now, how thoroughly need we clean our site? Is a fresh install of WordPress & restore from backup necessary?

Stress ??

Reply To: New User created | Blog got hacked

Steven Stern (sterndata) — Fri, 09 Nov 2018 01:14:21 +0000

Elido, yes. Once a site has been hacked, don’t trust it.