RVH

Thanks, I thought maybe there was a plugin that could do it. I have contacted Elegant Themes

Yes, it appears on the All Users page and I quickly delete it but it’s back the next day. I can’t figure out what is adding it. I’ve changed passwords on the database. BTW, That scan is from WP Activity Log plugin. Isn’t it strange that something is creating Wordfence activities?

Having done this a few times, after activating the plugin you need to go to its home page and request a free license. It will be sent via email with a link that when clicked will make your installation operational.

thanks, that did it.

Thanks, that’s a load off my mind. What scared me is the IP addresses, several of which are in China. Why so many?

Thanks, I have put the “find a new hoster” on hold for a while. It doesn’t make sense to transfer and infected site – or seven of them.

But please help me understand how these files got there. Am I right that there are only two ways, via FTP and via an infected plugin? On the latter, I’ve deleted then reinstalled all plugins thinking this might help. On the former, these files are showing up while the hoster has blocked all FTP on my account. I’m really confused.

Thanks, yes, I do maintenance almost every day. I use ManageWP and it scans all my sites and tells me what themes/plugins needs updating. So, I am always up to date. I also use Wordfence.

Other than change passwords, what can I do? When I get these attacks my hosting guys shut down FTP access and even with it off, I am getting malicious files. How can files be uploaded without FTP?

Here is an email I got this morning showing you what the malicious files are.

This email was sent from your website "Bob Hatcher's Weather Website" by the Wordfence plugin.

Wordfence found the following new issues on "Bob Hatcher's Weather Website" (1 existing issue was also found again).

Alert generated at Saturday 24th of August 2024 at 01:17:13 AM

See the details of these scan results on your site at: https://bobhatcherweather.com/wp-admin/admin.php?page=WordfenceScan

High Severity Problems:

* Unknown file in WordPress core: wp-admin/user/admin-ajax.php

* Unknown file in WordPress core: wp-includes/ID3/alpsigfc.php

* Unknown file in WordPress core: wp-includes/SimplePie/XML/tpmlxwyq.php

* Unknown file in WordPress core: wp-includes/blocks/nextpage/admin-ajax.php

* Unknown file in WordPress core: wp-includes/js/tinymce/utils/xbkfylem.php

* Unknown file in WordPress core: wp-includes/rest-api/brnttden.php

* Unknown file in WordPress core: wp-includes/sodium_compat/namespaced/sefcxrhu.php

* Unknown file in WordPress core: wp-admin/css/colors/ocean/php.ini (+ 251 more)

Thank you. I’ve now done all that about a dozen times. My question, though, is why it’s happening and if switching hosting vendors would be a good idea.

Presumably you created a new page then told WP to use it as the home page, right? I’m assuming your theme can then display blog posts.

Thanks, I’ve updated all passwords but forgot about the database. I think I will update that too. I’ll also spend some time with the links you posted.

Is it possible to get to the database other than through the hosting company’s website? Can it be accessed by logging onto my website?

Bob

Someone asked if my log files were any help, the answer is yes, the told me exactly what the intruder did and I was able to fix it all. My question, though, is, if anyone knows of any method, hacked plugin or theme, or something else that would allow an admin user to be created outside of WP?

Physically, unless someone had access to my database login info, how can a user be created from outside WP?

Problem solved. I had already cleared the cache on the phone/ipad but that did nothing.

The solution was to use FTP to empty the cache folder. Once I did that, all worked find. Key is to NOT delete the cache folder, but to empty contents.

Thanks, Lisa, that was wrong, the correct url is [link moved to proper field]

• This reply was modified 3 months, 2 weeks ago by James Huff. Reason: link moved to proper field

I’m no expert, but I’d try changing the permissions to not allow any changes.

Thanks for the quick reply. I figured it out and it was none of your (excellent) suggestions. Instead, I use IONOS for my hosing and I have “unlimited” storage, BUT there is a limit to the number of files 264k or so. I exceeded the limit. I deleted a few test sites I had put up and now all is fine.