Possible WP 2.5.1 Exploit?

  • Resolved ffrebirth

    (@ffrebirth)


    16 years, 9 months ago

    I recently upgraded to WordPress 2.5.1, and think that there may be some kind of exploit that allows someone to inject a virus into your files. Ever since I’ve upgraded AVG has been picking up a “JS/Download.Agent” on my website, so I downloaded a hard copy of all my files and scanned them with AVG.

    I found the virus in the file “wp-blog-header.php”, and then re-uploaded the original file and my website was fine once again. However, this morning the same virus threat came up again and this time it’s not in wp-blog-header.php. (The virus threat only comes up on the pages that are running WP, so it must be something to do with a WP exploit or something like that.)

    So I was wondering, has anyone else ever had something like this happen to them with WordPress 2.5.1?

Viewing 3 replies - 1 through 3 (of 3 total)

  • Did you clear all your cache before re-uploading, including java/javascript.

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    (The virus threat only comes up on the pages that are running WP, so it must be something to do with a WP exploit or something like that.)

    Maybe. Or your host (your blog server) might have already been compromised and the exploit keeps being re-added. Why do I think that is probably the case?

    I recently upgraded to WordPress 2.5.1,

    The 2.5.1 upgrade was a security upgrade which by now should be code for “Now! Do it now. No joke, right now.” When you say you did it recently that tells us that you waited. Finding blogs running exploitable code is a trivial matter and you probably have been exploited already.

    Take a look at Donncha’s often quoted blog posting and scroll down to the part that says “If you’ve been hacked”.

    It should not need saying but make backups of your files and database and be prepared to restore them in case of the Bad Thing happens (such as you bork your blog and it stops working).

    If you can export your blog to a file (Manage -> Export) look over that file in a text editor and confirm that virus you found is not there, then I suggest you start with a totally clean database, files, themes, etc. and build your blog from scratch using the exported data.

    Good luck.

    Thread Starter ffrebirth

    (@ffrebirth)

    Hey,

    I fixed the issue, thanks for your help everyone.

    Turns out that it was my cache regurgitating old files, even though I’d cleared it once before already.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Possible WP 2.5.1 Exploit?’ is closed to new replies.

Tags