Thanks to the team for getting a fix incorporated for this. We appreciate it.
Here’s what I did to stop the spam emails. While the updated plugin should fix this particular case, what we have been seeing is a successful attack through a method that would remain to use against other plugins. I’ve shut down the method that was used here so it can’t be used for future attacks.
This will work for people who have access to the file system at the hosting site, and who are comfortable editing configuration files.
IF YOU MAKE A MISTAKE EDITING THIS FILE, YOU CAN BREAK YOUR SITE, in ways that are difficult to diagnose.
BEFORE YOU DO ANYTHING, MAKE A COPY OF THIS FILE SOMEWHERE!
The file involved is .htaccess (notice the leading period), in the directory that contains wp-admin, wp-content, etc.
When I looked at my access logs, I noticed that there were many connections using the curl user agent. Curl is a command-line program to access web sites, that is singularly unsuited to looking at WordPress sites. No valid user will be coming in this way. What’s going on? I also noticed that there were curl HTTP POST operations, which is how data are sent to a website (as opposed to getting information from the site), and the timestamps of those POSTs matched the fake subscriptions. Bingo!
So I closed down curl access to my site, by adding these lines to the top of my .htaccess file. It must be before the lines added by WordPress.
# Added to stop curl access!
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^curl
RewriteRule ^.* – [F,L]
# End of curl elimination
I’ve now gone 18 hours with no new fake subscriptions; unheard of in the past few weeks.
As I said earlier, this cuts out a broad class of attacks, and in my opinion is worthwhile even when we have the new plugin.
Hope this may help some people, and again, THANK YOU to the team for this plugin and the upcoming fix for this problem.
-Al
