compromised ecommerce website – urgent help needed

  • My website appears to be compromised and I’m not entirely sure how.
    I need help, as quickly as possible.

    I have a self hosted ecommerce site using woocommerce, paypal and stripe for payments. A fair few orders have come in over the last 4-6 weeks, most likely due to Christmas, and I’ve been a bit overwhelmed with fulfilling orders that I skipped over looking at where payments were going to.

    I noticed yesterday that an order came through with BACS as a payment method and as we do not accept BACS, decided to check the backend where Stripe was disabled, Paypal enabled but with another person’s email address in place of mine.

    I’ve spoken to Paypal and they’re doing an investigation, but I also changed passwords and checked my user accounts to make sure there were no unauthorised admin.

    Several hours later, I get a user registration email and see the account has used my admin username with a “2” at the end. I tried to login but my password had been deleted or changed, so I reset, went straight to the payments section and once again, stripe has been disabled, paypal is routed to another email address.

    I’ve put the site on maintenance mode, logged that user out and deleted the account, changed my password and changed the login url for the backend, but I know that’s not enough.

    So far, I’ve lost around ￡2.5k in sales money and I’m not hopeful Paypal will be able to recover it.

    I need to know what I can do at this point to get my site safely back online and how this person managed to get in. My passwords are those randomly generated Google passwords, so nothing that should be easily solvable.

    What can I do?

    As a side note, I purchased an affiliate plugin several months ago and realised last month it wasn’t working. I contacted the developer and they asked for backend access to the site. Not wanting to give them access to everything, I installed a plugin and limited their access to various sections, however they insisted they needed access to restricted sections in order to check why it wasn’t working.

    I created their login as a new Role type and didn’t give them admin rights or anything near, however they’re the only people who had privileges beyond customers and the timing between giving them access and no longer receiving payments through paypal is only off by 2 days.

Viewing 8 replies - 1 through 8 (of 8 total)
  • Moderator t-p

    (@t-p)

    Carefully follow this guide.

    When you’re done, you may want to implement some (if not all) of the recommended security measures and start backing up your site.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Off hand, couple of names that come to mind are Sucuri and Wordfence.

    Thread Starter Dtre

    (@dtre)

    thank you.
    I read through this first, but wanted to post in case there was something else I should be doing.
    I’ve installed sccuri and am told “core files were modified”

    There was a WP File manager installed yesterday that wasn’t there before and isn’t there now, so highly possible that files were modified.

    I’m going to find some painkillers to shake this headache and then get on with everything else.

    thanks again

    Moderator t-p

    (@t-p)

    There was a WP File manager installed yesterday that wasn’t there before and isn’t there now, so highly possible that files were modified.

    First off, WordPress core does not arbitrarily install or delete plugins/themes. Somebody has to install/delete a plugin or a theme.

    That said, WP File manager is a legit free plugin available at https://www.ads-software.com/plugins/wp-file-manager/

    Any questions regarding this plugin, I recommend asking at https://www.ads-software.com/support/plugin/wp-file-manager/ so its developers and support community can help you with this.

    Thread Starter Dtre

    (@dtre)

    my point was that I didn’t install the plugin, so whoever has been messing about in the backend did and has probably used that to get to files on the server and modify them as per the results of the sucuri scan.

    Hopefully my files haven’t been backed up elsewhere. I’m tempted to move to shopify, but I’m stubborn.

    I’m not sure there is any malware installed or that I was hacked, more that someone gained access and decided to intercept payments, so I don’t know what I should be cleaning as a result

    Thread Starter Dtre

    (@dtre)

    looking through my main directory, I’ve seen files that I don’t recognise.

    atminernya.php
inside, the header reads 

/** Adminer - Compact database management
* @link https://www.adminer.org/
* @author Jakub Vrana, https://www.vrana.cz/
* @copyright 2007 Jakub Vrana
* @license https://www.apache.org/licenses/LICENSE-2.0 Apache License, Version 2.0
* @license https://www.gnu.org/licenses/gpl-2.0.html GNU General Public License, version 2 (one or other)
* @version 4.8.1

    the website in the header takes me here: https://www.adminer.org/
    this appears to be an alternative to PHPMyAdmin
    I have a few other wordpress sites hosted and I don’t see that file in any of them.

    I’ve also seen WooCommerce Paypal Payments last modified today

    screen shot which was maybe 20 minutes before I received the New User email

    In Woo payment settings, there are three Paypal options, the one selected is the one they keep playing with

    screen shot, however in Plugins , there’s only 1 Paypal plugin and it’s not even enabled
    screen shot

    Anything here out of the ordinary?

    Moderator t-p

    (@t-p)

    so I don’t know what I should be cleaning as a result

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Off hand, couple of names that come to mind are Sucuri and Wordfence. There may be some more organizations expert in this that I’am not aware of.

    The fact that a) plugins are bring added, b) strange filenames are appearing, c) your passwords are being changed, d) core files are bring modified, means someone has gained full access to your wordpress installation.

    Start methodically cleaning your site or get some professional help. Changing passwords is not enough unfortunately.

    Good luck!

    If WP File manager was installed, then it means the hacker has got access control to your server via .htaccess file and your WP config file, so your database with customer details is accessible too. You need to make a full zip archive backup of your site AND database, and store it off your server. You need to change all your passwords…. admin AND database password. I suspect they can remote access into your database with everything they have. This might be why you are seeing different values in some fields.

    You need to find that vulnerability and harden your WordPress.

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘compromised ecommerce website – urgent help needed’ is closed to new replies.