Security flaw suspected

The offending file has been identified as
/home/plan2040/public_html/wp-content/plugins/genesis-featured-page-advanced/languages/xmxweoko.php

Most likely malware is installed in random or well-know directories and the installation folder doesn’t indicate how it got in. It doesn’t tell you anything about how the break-in occurred at the first time.
I would recommend scanning the whole hosting account for malware.

This is what I am suspecting now as the file xmxweoko.php is not native to the plugin.

Good morning peterlaz,

Thanks for reaching out and I am truly sorry that you have been hacked. You are correct that the file xmxweoko.php is absolutely not native to the plugin. It is very common for hackers to hide malicious files throughout your site once they have access. I completely agree with Adam’s comments above, make sure to scan the whole hosting account for malware. I might suggest using the plugin Wordfence. It is very good for detecting vulnerabilities.

As far as the plugin itself. I am not aware of any security vulnerabilities in the core plugin code. I have also run it through numerous checks including Wordfence. I take these situations very seriously so if you or your host needs any additional information, please let me know!

Thanks,
Nick

Thanks Nick for reaching out promptly.

My early suspicion of a flaw in the code is proven to be baseless. After working extensively with my hosting company I have positively identified issue.

The issue is documented in https://wpvulndb.com/vulnerabilities/8807

The hacker somehow gained access to my website and planted the file xmxweoko.php in the plugin folder wp-content/plugins/genesis-featured-page-advanced/languages/

This could possibly allow the attacker to intercept the email containing the password reset link in some cases requiring user interaction as well as without user interaction.

Admittedly the site in question was only a test site without much security setup. I have deleted the entire site and will start again fresh as it is only for testing purposes.

Luckily, my live sites are adequately protected with premium security plugin. A scan with Sucuri’s site scanner shows they are all safe.

Once again thank you very much for this lovely plugin.

Great, I am glad you got it sorted. Being hacked is terrible, I have been in your boat a few times. And thanks for the kind words regarding the plugin!

Best,
Nick