My wordpress header.php got hacked

http://www.arlocarreon.com/blog/wordpress/wordpress-header-php-got-hacked-snxstat77-info/

by mexitek • 14 years ago

2 3 14 years ago

mexitek• 14 years ago

i still have no idea how they got that code in the header.php. Anyone have any ideas?

barik• 14 years ago

The usual way that these get in is when people upgrade WordPress by simply doing a tar -zxvf wordpress.tar.gz. This replaces files, but often there are many legacy files from older installs that never got deleted.

In my case, the attack was from "/blog/wp-content/themes/default/functions.php", which isn't even a theme in recent WordPress builds; it's simply been left over from the many upgrades over the years.

The other most common route for such injection is not always WordPress itself, but instead through insecure, third-party themes, since theme designers are not always programmers.

adduc• 14 years ago

One of our clients had their FTP credentials compromised causing a similar effect. It may be a decent idea to check the logs and identify if this was the method of entry.

My wordpress header.php got hacked

Related Stories