Home » AWSOM News » Spam Hack in Progress across WordPress sites

Fundamental Website Setup Links

Spam Hack in Progress across WordPress sites

There is currently a large scale spam attack on WordPress sites that is ongoing and affects primarily WordPress versions 2.1.x and 2.2.x (it’s not clear if 2.3.x or 2.0.x are affected, but it seems likely they aren’t). The attack results in a large number of spam listings injected into either posts or theme files which are then set to be hidden through css. Your will typically find that you’ve been affected when Google contacts you to say you are being de-listed due to a high number of spam links on your site. It is also typical for the attackers to delete all of your pages from your site for some reason, so if you load your site and all of your pages are gone you may have been hacked.

It’s not entirely clear what method the hackers are using to get admin access to the affected sites, but from my observation it may be a privilege escalation attack using the comment system. In some cases a random user account was created right before the attack. It was also noted that the comments.php theme file was altered to add in a console access applet which allowed for low level server access. If you get hacked make sure you check every theme file to make sure no malicious code was added–or better yet, reload your theme files from a backed up or fresh copy, and delete out any suspect user registrations.

WordPress 2.5 is apparently not affected by this problem, so an upgrade should help. I have upgraded my sites to 2.5 and have managed to mostly get things working (though my archive page on this site is currently non-functional). It looks like this is the unfortunate little push that will force most people to upgrade, though I strongly suggest making sure first that there are updated plugins that work with 2.5.

AWSOM Powered