Hacked Wordpress site what to do?

B

Bhankas

Regular Member
Joined
Feb 13, 2023
Messages
261
Reaction score
139
Hi all
My charitable website has been apparently hacked. It has three new administrators and despite deleting them from front-end/PhpMyAdmin, they reappear. Though the website is running, I don't know how to remove them. Can anyone help ? Thanks in advance.
 
Advertise on BHW
Change all your passwords, scan the site with security plugins, check the configuration and initialization files, check the wp-content/uploads folder (or a similar uploads folder) it should only contain images and documents and reset active sessions using WordPress salts. Well, I think I've covered everything.
 
Probably a good idea to hire a professional help from Hire A Freelancer section
 
Give more information so we can help better. like how long has it been happening, have you scanned or changed passwords or anything, is it just wordpress hacked, and do you have backups, how complex is your site and plugin count, and do you have any other sites on hosting plan, and how experienced with file manager and cpanel are you, and any other info that can help? It could be simple as functions.php script or maybe you need a fresh start instead of going through every file.
 
Take a backup first, and export what you can. Use Malcare to scan your website. What you're experiencing is because of a hidden shell on your site. Find it and remove all copies of it. It's not as simple as it sounds, but it's a start.
 
Jason Starkey said:
Give more information so we can help better. like how long has it been happening, have you scanned or changed passwords or anything, is it just wordpress hacked, and do you have backups, how complex is your site and plugin count, and do you have any other sites on hosting plan, and how experienced with file manager and cpanel are you, and any other info that can help? It could be simple as functions.php script or maybe you need a fresh start instead of going through every file.
Click to expand...
Thanks for your reply.

The website has hardly any visitors, no sales happening there, running from the past three years. A kind of informational one. It happened yesterday only when I got an email about a new user being added. Inside I found three new admins, two of them using wordpress.org as their emails. I never thought a lame website like mine could be targeted.

I installed Wordfence and it identified a php file with a red dot and I deleted the file. No other indications. Can use cPanel and file manager. Tried deleting their existence in PhpMyAdmin but the names appear back instantly.

A month back WpBakery plugin alarmed me saying a vulnerability in PHP exists and I should update, but many plugins use version 8.2 and I feared that would involve lot of changes and I did not attempt.

I do have a backup, problem is sometimes it installs properly on localhost, sometimes not. My fear is, if I delete the whole website and reinstall, it may not work as expected.
I used Chatgpt and followed instructions, the results matched what Wordfence suggested, nothing more. It says another file has been infected.

V said:
Take a backup first, and export what you can. Use Malcare to scan your website. What you're experiencing is because of a hidden shell on your site. Find it and remove all copies of it. It's not as simple as it sounds, but it's a start.
Click to expand...
Thanks. I will use it and then report back.


I would appreciate any other help.
 
V said:
Take a backup first, and export what you can. Use Malcare to scan your website. What you're experiencing is because of a hidden shell on your site. Find it and remove all copies of it. It's not as simple as it sounds, but it's a start.
Click to expand...
Malcare showed this:
Vulnerability Details
Description:
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion

Some plugins behaved irratically when I changed my WP version in localhost, so I have not upgrade my site.
 
Bhankas said:
Malcare showed this:
Vulnerability Details
Description:
WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion

Some plugins behaved irratically when I changed my WP version in localhost, so I have not upgrade my site.
Click to expand...
WP Plugins are the no. 1 culprit for getting websites hacked. If you have an old backup, I would suggest you update every plugin that you can and work from there. Remove everything from the old installation. That's the only solution. Otherwise, be prepared to scan 1000s of files for a shell that won't be easy to identify. Plus, they keep the shells in multiple locations with different names.
 
i had a news website it was getting hacked on wordpress. after installing ninja firewall no more hacks
i blocked all wordpress api requests.
wipe everything except ur plugin and theme directory check database manually for any unknown code or use codex
 
deleting them alone won’t fix it
put the site in maintenance mode and contact your host
rotate hosting, admin, database, and ftp passwords from a clean device
also check for compromised plugins
 
Most probably a hacker injected code into one of the website files .
Use a plugin like Wordfence or Sucuri Security to have a deep scan of the website .

and look for a modified file .
 
Contact your host and check you have the latest PHP version with all the security updates of recent alerts. Thats the first thing. PHP is the operating system language for your site, so you need to make sure its at the latest version.
 
Can't you check the logs? If someone logged in , uploaded a shell (in any language but commonly PHP ) into your website you should be able to check what they did through the logs.
This is the easiest way to trace the main shell file.
 
I saw the logs, surprisingly the IP address shown is my own.
 
Okay, if deleted admin accounts keep reappearing, it strongly suggests there's still a backdoor or malicious code somewhere.

The first thing I'd suggest is finding and removing the backdoor. Even if you install a fresh WordPress site, you could get hacked again if the underlying vulnerability or compromised server files are still there. Maybe not immediately, but after a few days.

A few questions:
  • Are you using shared hosting, VPS, or a dedicated server?
  • How big is your database?
  • What PHP version are you currently using?
 
I think you have no choice but to upgrade WordPress to the latest version, as versions 4.7 through 7.1.3 are highly vulnerable to security exploits.
 
Check if you have some kind of "File Manager" software - plugin. Delete that.

Some plugins may add/make their own account. So it may look it´s "hacker account"
It´s possible, that there is somekind of "snippet code" somewhere in the files.
Disable/delete comments from the site.
 
It is obvious some script is injected in some files that triggers adding administrators, but finding the culprit, without any help is problematic.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top