Does this seem like a vulnerability search?

I use the slimstat plugin on one of my websites that uses wordpress for a platform. Today I noticed some strange activity in the activity log for the website. There was a whole slew of page requests from ip 192.187.111.114

/webmanage/fckeditor/editor/filemanager/connectors/test.html
/editor/filemanager/browser/default/connectors/test.html
/webeditor/editor/filemanager/browser/default/connectors/test.html
/editor/editor/filemanager/connectors/test.html
/manage/fckeditor/editor/filemanager/browser/default/connectors/test.html
/webeditor/editor/filemanager/connectors/test.html
/editor/editor/filemanager/browser/default/connectors/test.html
/admin/fckeditor/editor/filemanager/connectors/test.html
/fckeditor/editor/filemanager/connectors/test.html
/fckeditor/editor/filemanager/browser/default/connectors/test.html
/admin/fckeditor/editor/filemanager/browser/default/connectors/test.html

These all received 404 errors, but it looks like someone was really wanting to find fckeditor. It made me wonder if someone was searching for some kind of vulnerabilty.

Is there some kind of known vulnerability that can be taken advantage of with fckeditor? Has anyone else come across something like this in their logs? Just curious about it.

See:
https://wordpress.org/support/topic/hack-with-ckeditor
https://wordpress.org/support/topic/anyone-have-an-idea-of-what-this-means

I'd say that is just unsuccessful hacking attempt. Nothing more. Get some security plugin (e.g. Wordfence) for WP and you're golden.

This is an example of what they were searching for: http://thedeparturelounge.com.au/blog/admin/FCKeditor/editor/filemanager/browser/default/connectors/test.html

It's upload interface, and if not secured properly, allows to upload all kinds of stuff to your accounts. My guess would be that the person who has the opportunity to upload things to your account would place malware on it or do similar nasty things.

It is a spam bot, looking for comment box/editor footprints.

http://www.forumpostersunion.com/showthread.php?t=28734
https://www.projecthoneypot.org/ip_192.187.111.114
https://isc.sans.edu/ipinfo.html?ip=192.187.111.114
http://stopforumspam.com/ipcheck/192.187.111.114
http://ipmap.info/ip/192.187.111.114.html


EDIT: It is looking for file upload vulnerability
https://isc.sans.edu/diary/Scans+for+FCKEditor+File+Manager/17821

SharkServers said:

See:
https://wordpress.org/support/topic/hack-with-ckeditor
https://wordpress.org/support/topic/anyone-have-an-idea-of-what-this-means

I'd say that is just unsuccessful hacking attempt. Nothing more. Get some security plugin (e.g. Wordfence) for WP and you're golden.

Click to expand...

I'll take a look at the links you gave. It isn't anything I'm overly worried about since it was unsuccessful anyway. Was just kind of curious about it.

I get a few of these per day on most my WP sites. Not to worry if you're updating WP regularly.

bartosimpsonio said:

I get a few of these per day on most my WP sites. Not to worry if you're updating WP regularly.

Click to expand...

Yep me too, as SharkServers suggested earlier, WordFence does the business for me.

https://wordpress.org/plugins/wordfence/
http://www.wordfence.com/