Theme-editing exploit?

once again, what you pasted is not the hack.. its simply the file access. I stress this because its nearly identical to another post here.

You cannot, once again, you CANNOT, open wp-admin/theme-editor without having the proper credentials.

If you examine what you pasted, you can see that they logged in.

Install my plugin that provides logging..if you want to see exactly what is going on

https://www.village-idiot.org/post-logger/

Im also going to go out on a limb and say that since Ive seen that exact thing on older installs that were exploited, that your password was compromised some time ago.

Here’s my bet.

You install my logging password.

you change your password.

within a day, you will see older exploits attempts that worked on the older versions for grabbing your admin password.

Thank you. That explanation does seem most likely. I have installed your plugin and changed my password and will watch the log.

I received an email from Google saying one of my sites (only a wordpress blog) was compromised and that any results for this site would now feature a warning from Google. Long story short, I discovered the exact same code in my blog and removed it. This seems like a definite exploit in wordpress (2.3.3 here).

I had the same problem. I only found out after I upgraded to 2.5.1 and decided to completely reinstall my blog (except for the database).

After a little bit more than half a week today I finally got lucky with the post-logger.

<?xml_version = \"1.0\"?>
<methodCall><methodName>metaWeblog.getRecentPosts</methodName>
	<params>
		<param><value><string>C6CE3FFB3174106584CBB250C0B0519BF4E294</string></value></param>
		<param><value><string>UserName</string></value></param>
		<param><value><string>PassWord</string></value></param>
		<param><value><int>1</int></value></param>
	</params>
</methodCall>
78.90.14.123
/xmlrpc.php
May 11, 2008, 11:20 pm

There it was my (now invalid) password from some host in Bulgaria.

Now what should I do with this information?

youre using my post-logger plugin? ??

That, btw, should be an old exploit.

I am SO glad to know that that captures xmlrpc requests.

Now what should I do with this information?

Like I said, that should be an old exploit.

If you want though, you can pass that on to [email protected] and ref. this thread. Rest assured, that if it isnt, Matt will come along and edit this thread.

—

And good for you, for not only upgrading but for being proactive, and no doubt, curious enough, to use my plugin to locate the ‘presumed’ entry point. WP needs more warriors.

whooami, I downloaded your post-logger, but am not sure how to install it.
When I go to my WordPress admin page, I get this code:
c1608e58b7a40647381b4667630bf061
82d58bfc8dc7a2fa985939b01d5b694f
69175bee376c12eba6ddbd1f632a7f10

Same thing I’m seeing when I try to go to my blog page.

I do have ftp access to the server & have Fantastico through my host. If I install a new version of WordPress over my old one, will my posts remain intact?

sonnata,

I havent a clue why you are seeing that. But its showing up in google’s cache of your site from May 6.

https://64.233.167.104/search?q=cache:69PNZCe1jk4J:www.homeproductsnmore.net/+https://www.homeproductsnmore.net/&hl=en&ct=clnk&cd=1&gl=us

Youre worrying about apples and oranges — apples being those numbers, and oranges being my plugin.

In other words, theyre not related.

You need to fix the problem with your blog before installing any plugins.

If I install a new version of WordPress over my old one, will my posts remain intact?

If you can follow instructions, of course they will. But, like I just indicated, what you are seeing might be a sign of something that necessitates more than simple upgrade.

I did not have your plugin installed before this problem occurred. I was hoping it would help me track down the cause of it.

I have tried upgrading WordPress according to the link you gave me, with both the Three Step Upgrade as well as the more detailed upgrade instructions.

Neither worked. Still still seeing this code on both /wp-admin/ page as well as https://www.homeproductsnmore.net/

c1608e58b7a40647381b4667630bf061
82d58bfc8dc7a2fa985939b01d5b694f
69175bee376c12eba6ddbd1f632a7f10

BTW, this is the only thing that appears on either psge.
I have backed up my database. Would moving it to another host & reinstalling wordpress there fix this?
I’m at a loss as to what to do at this point.

Same problem for me today. Files were named co_wp-app.php , co_404.php, etc….
If I delete xmlrpc.php, what would be the effect on these attacks? Would I be able to use pingback or receive pingback?

if you remove or rename xmlrpc.php you will not be able to receive pingbacks. I dont know about sending them, though. Trackbacks should still work.

You should check this too: https://www.bloggerguide.net/blog-platform/wordpress/wordpress-exploit-giving-backlinks-redirects-and-headaches-but-no-visitors/