Spam Injector Disguised as a License Key
Moe O A client reported some weird spam URLs injected on their WordPress website and after an investigation, it turned out that the hacker was hiding the…
Browsing Category
WordPress Security
669 posts
OWASP Top 10 Security Risks – Part III
Gerson Ruiz To bring awareness to what threatens the integrity of websites, we are continuing a series of posts on the OWASP top 10 security risks. The…
Using Innocent Roles to Hide Admin Users
Cesar Anjos All across the internet, we find guides and tutorials on how to keep your WordPress site secure. Most of them approach the concept of user…
Side Effects of the Site_url Hack
Denis Sinegubko We\’ve been cleaning many sites infected by the so-called site_url hack–the result of the WP GDPR Compliance plugin vulnerability. The sites are broken because their…
Hackers Change WordPress Siteurl to Pastebin
Last Friday, we reported on a hack that used a vulnerability in the popular WP GDPR Compliance plugin to change WordPress siteurl settings to erealitatea[.]net.…
Erealitatea[.]net Hack Corrupts Websites with WP GDPR Compliance Plugin Vulnerability
Pedro Peixoto We have noticed a growing number of WordPress-based sites that have had their URL settings changed to hxxp://erealitatea[.]net. Further investigations show that the issue is…
New WordPress Security Email Course
Rianna MacLeod Recent statistics show that over 32% of website administrators across the web use WordPress. Unfortunately, the CMSs popularity comes at a price — attackers often…
Fake Wp.org/jquery.js
There is a long-lasting malware campaign (dating back to at least 2016) that injects fake jQuery scripts: <script type=”text/javascript” src=”hxxps://www.XX[X]wp[.]org/jquery.js”></script> Where XX[X] are 2 or…
Saskmade[.]net Redirects
Earlier this week, we published a blog post about an ongoing massive malware campaign describing multiple infection vectors that it uses. This same week, we…
Multiple Ways to Inject the Same Tech Support Scam Malware
Last month, we shared information about yet another series of ongoing massive infections using multiple different vectors to inject malicious scripts into WordPress websites. Shortly…
Backdoor Uses Paste Site to Host Payload
Bruno Zanelato Finding backdoors is one of the biggest challenges of a website security analyst, as backdoors are designed to be hidden in case the malware is found…