Coral Casino,Geely 2025.Recharge Every day and Get Bonus up-to 50%!

Malware in the Plugins directory

singer74 — Sat, 01 Apr 2017 03:16:28 +0000

[ Moderator note: moved to Fixing WordPress. ]

After installing a plugin recently (ShareThis) from the WordPress plugins directory, I decided that it wasn’t what I expected so I deactivated and then uninstalled it. Guess what? Not only is there still a “ShareThis” tracker running in the background on my site, but the elements are still on my page. This plugin is MALWARE at this point. Why is it still in the directory? Better yet, does anyone have any idea how I can actually get rid of it? I contacted the developer through the support forum to no avail (surprise!).

Reply To: Malware in the Plugins directory

Kenneth Feldman — Sat, 01 Apr 2017 08:02:55 +0000

Agreed. ShareThis and the Simple Share Buttons Adder (PRO) all do the same thing. No reply from developers. Why is this allowed?

Reply To: Malware in the Plugins directory

Jan Dembowski — Sat, 01 Apr 2017 11:53:36 +0000

Sorry, but that’s not malware.

*Drinks coffee and moves topic*

Those plugins are software as a service. That means the plugins are an interfaces to those other companies servers. That’s allowed and the code for the plugin is 100% GPL compatible.

The code on their servers may not be but again, that’s allowed as software as a service.

I’m not being glib here: if you don’t like their service then do not use their plugin.

I decided that it wasn’t what I expected so I deactivated and then uninstalled it. Guess what? Not only is there still a “ShareThis” tracker running in the background on my site, but the elements are still on my page.

If you are not getting help from the plugin author then the Fixing WordPress (this forum) is the place to ask for help.

What is the URL of your site?

Reply To: Malware in the Plugins directory

singer74 — Sat, 01 Apr 2017 14:42:21 +0000

Hi Jan,
Appreciate your reply, the site is here. Also I’m sorry, but it is very definitely spyware, which falls under the general umbrella of malware, doesn’t it? This is what the American dictionary says of spyware:

spyware (spī?war?)?
n. Software that secretly gathers information about a person or organization. (Check!)
n. Any malicious software that is designed to take partial or full control of a computer’s operation without the knowledge of its user. (Check! — in that it can’t be removed or stopped)

I think I may not have been quite clear. The ShareThis plugin installed non-removable VISUAL elements on my page and in my code — see screenshots below. When I say non-removable I mean they persist after so-called uninstall, and that is definitely NOT okay. This is doubly true in this case, where it was not disclosed that elements and code would be permanent even after “uninstall” — that’s ridiculous.

I’m trying to make someone higher up aware of this thing because there’s no way this should be allowed in the official WP plugins directory. I could understand if it were a plugin I had downloaded from a third-party website, but I got this right here on WP.org and that is so wrong.

Visual elements still on page
Code still in page source
Active tracker
Plugin not installed

Reply To: Malware in the Plugins directory

Jan Dembowski — Wed, 05 Apr 2017 01:08:27 +0000

I’m trying to make someone higher up aware of this thing because there’s no way this should be allowed in the official WP plugins directory.

Feel free to contact the Plugins team via [email protected] if you like. Please don’t be disappointed if they explain Software as a service again.

Reply To: Malware in the Plugins directory

Samuel Wood (Otto) — Thu, 20 Apr 2017 14:07:34 +0000

When I say non-removable I mean they persist after so-called uninstall, and that is definitely NOT okay.

That would be correct, if it was true. It’s not. Removing the plugin removes the code for it as well. Checked. Tested.

Now, you may have some aggressive caching happening on your site. Not uncommon for full-page HTML caching to exist. With aggressive caching, when you change the content of your site, you need to clear the cache to see changes occur. That’s the most likely explanation.