Alberto

I’m also using Woocommerce Stripe Gateway plugin, and have been hacked.
So it must me something related to this plugin or Woocommerce itself.

@madjax

I have all those settings unchecked, but they successfully managed to create the fake order and the fake user.

As per WordPress best practices after an hacking happened or attempted, it is also recommended to change your security keys in wp-config.php.

You can generate new keys here: https://api.www.ads-software.com/secret-key/1.1/salt/

This will also logout every user connected to the website and invalidate its cookies.

Same here.
Not using TI Wishlist Plugin.

I have some securities (not going to specificy which ones, as this thread is surely monitored by who is running this hack) that prevented more damage, but I found a new “client” and a failed order.

By inspecting logs, I verified that the bot tried to exploit several known vulnerabilities in the following plugins:
– Loginizer
– Drag and Drop multiple file upload for Contact Form 7
– Super Store Finder
– Super Interactive Maps
– Super Logo Showcase
– WP File Manager

I have none of them, but if you have, disable and delete them immediately.

I didn’t find any modified WP file or modified settings, but now I need to audit everything…

As you can see from the logs above, error occours when WP Statistics tries to allocate 268 Mb of memory. In fact memory limit on my website is already set at 256 M.

I sorted out deleting a plug-in that was 2+ years old.

I didn’t realize it was so old.

Thanks for your help.

Hello everyone and thanks for your support.

I scanned my website with the suggested tools and I can confirm that my website is not compromised.

But today it happened again! Last time, I installed Activity Log plug-in, and this is what it looks like it happened:

View post on imgur.com

As you can see, someone not logged in (acting as a guest) updates setting “users_can_register” and default role. Then he creates a new user, and finally updates again the same settings to restore them as before.

As far as I know I never saw someone experiencing this kind of compromission. I can provide more info to anyone interested.

Thank you.

After further investigation I found that w3-total-cache was not the responsible for the slowness. Thanks anyway.

Yes I do.

Same problem here with 2 websites hosted in the same server.

Can you share your solution?