seems to be allot of MySQL injection hacks to open the door for a fullsite hack;
. . .
would like to know if there a way to block ‘username and password changes’ altogether for anyone else reading this post.
There really isn’t a way to block those changes inside WordPress.
Sorry for being a little snarky before. This reply’s going to be lengthy.
I sympathize but from what you’ve said here’s the real problem:
If you run WordPress (or any software, CMS or otherwise) on an insecure host than it won’t matter what you do. It’s your host that is compromised and your WordPress is getting hacked as a result.
If you run insecure WordPress plugin or you run an insecure old version of WordPress then the same also applies. Those links you’ve provide demonstrate that clearly.
WordPress relies on your MySQL database. You can setup all the controls in WordPress to prevent username and/or password changes but it won’t matter because the MySQL entries are getting changed.
What hardening your WordPress install does is makes it harder for the attacker on the shared host to create and modify files that let them attack your MySQL database. It is an attempt to try and prevent people from using your installation’s files and directories as the vector for hacking your server (WordPress included).
But if someone gets root access to your server, or they get direct access to your MySQL database then none of this matters because they can just override all that hardening. That’s how attackers exploit insecure plugins and old versions; they get the software on your host to do the dirty work for them.
Now those exploits you’ve listed above? Not one of them is a core WordPress vulnerability with the current version. They are either exploits from old versions (3.1.3) or exploits via add-on plugins.
If this keeps happening to you or the people you are trying to help, then you may want to consider using a managed WordPress provider that can keep these blog running safely and securely.
