0

Today I noticed three of my WordPress sites were hacked and were redirecting visitors to other sites. It took me a while to figure out what exactly was changed. Apparently, "siteurl" and "home" were changed in the wp_options table.

I'm not entirely sure which version of WordPress these specific sites used, but since I check for a new WordPress version at least once a month, it must have been 5.4.x. Oddly enough, one of the hacked sites says it's using v4.9.8. I can't (easily) check the others since I have not yet gained control of the Dashboard.

So how did this happen? Was this a known vulnerability in WordPress or perhaps one of its plugins? How can I investigate this further?

Edit: I also just noticed most (if not all) posts have been changed and also redirect to other sites.

Edit 2: I checked all WordPress files and none were world-writable but I did see one glaring mistake I made and which all hacked sites had in common. Of all those three sites I edited wp-config.php by hand leaving a world-readable backup (wp-config.php~) behind. This file contains the WP database's user and password. But I still don't understand how they used that to change the database. How did they gain access to MySql?

1
  • WordPress regularly has vulnerabilities and requires regular, and quick, patching. Your site got hit before it was patched. There's no way to tell when or what vulnerability was exploited. The best you can do is do a fresh install of WP and clean up your data. Make sure you make regular back ups. – John Conde Jul 14 '20 at 11:46
1

You should look at if your WordPress folders on the hosting server are writeable, especially the wp-config.php file. I can easily set the siteurl and home as constants via this file and then WP on its own will update this in the database, thereby sending users to that link instead.

What I would do if I were you would be to look at some of the plugins and themes that you installed in the past and ensure that those are secure. Your file permissions have definitely been compromised. Using a tool which keeps an eye on these files can help you prevent this in the future.

1
  • None of the files were world-writable but I did see one glaring mistake I made and which all hacked sites had in common. Of all those three sites I edited wp-config.php by hand leaving a world-readable backup (wp-config.php~) behind. This file contains the WP database's user and password. But I still don't understand how they used that to change the database. – Zippy1970 Jul 14 '20 at 11:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.