Nick Scott
Forum Replies Created
-
WFSupport,
I checked the database on my site and no user with an ID of 8888 or 88888 exists. In fact, the Wordfence log shows that “systemwpadmin” logged in with an ID of 10. That ID no longer exists in my database.
Nick
Brian,
WordPress, Genesis and the themes are all at the latest levels. WordPress is at v4.1, Genesis is at v2.1.2. Beyond the Outreach theme at v2.0, it was the latest levels of Twenty Fifteen, Twenty Fourteen that got hacked.
Thanks for listening ??
Nickverdipro –
I too received a notification this morning that a user “systemwpadmin” had signed on to one of my sites. I also received an email from Wordfence telling me that the functions.php file from 5 of my (inactive) themes had been modified. When I checked, I found a block of code had been inserted at the beginning of these files.
It was a simple enough task to replace the files using the Wordfence Scan panel. However, I found that the functions.php file for both my active theme (Outreach 2.0) and Genesis also contained the inserted hack code! I am not very happy that Wordfence MISSED this!!
I did a little Google-ing and discovered that this “systemwpadmin” User ID inserts itself into your database with an ID of 88888. The user is not visible from the standard WP Users panel, but exists as a hidden entry in the database. This information came from posts that are 1 and 2 years old now. When I checked my database, no such entry existed. Only entries for valid users. My suspicion is that the hacker(s) responsible for this intrusion have become more sophisticated and now erase all trace of the user ID after they have inserted their code.
Bottom line: Inspect ALL the functions.php files on you site and repair any that contain this hack.
AND… Wordfence – if you are listening – Your scanning code needs to be repaired to include all of the existing themes present on the system – Genesis and Outreach included!
Confirmed. v3.5.5 of the plug-in has corrected the database backup bug.
I have the same problem with two of my sites – 500 error when I try to create a database backup. This happened after updating the plug-in from v3.5.3 to v3.5.4. I’m running WP at v3.5.2.
I fixed the problem by uninstalling v3.5.4 of the plug-in and re-installing v3.5.3. Of course I had to go through and reapply all of the settings. But now my backups work again.
Any fix for this in the near future?
Nick