edubz15

<?php
$file = $_GET['file'];
$ext = pathinfo($file, PATHINFO_EXTENSION);
$match_array =array('pdf','mp3','mpa','ra','wav','wma','mid','m4a','m3u','iff','aif');
if(in_array($ext,$match_array)){
header("Content-type: application/".$ext);
preg_match("/[^\/]+$/", $file, $matches);
$last_word = $matches[0]; // test
header("Content-Disposition: attachment; filename=". $last_word);
readfile($file);
}
?>

Above is the download.php file that is executed to return a pdf file in my uploads directory to the user.

Had this same hack by the same user happen to a site I host a few days ago. Functions.php also was injected with base64 code. I would guess this is a bot exploiting an issue with a plugin as I do not have the same theme as you. Perhaps Wordfence is the issue? Can you list your plugins and versions so that we can compare and find the cause of this.

I feared it may have been an issue with my host/server. Thanks for all of your help I will let you know if I get this resolved.

I Just tried it again after re syncing the data with no success.

okay thank you I will wait it out and get back to you.

Okay, I can now view them from a logged out facebook. Please I’ve tried to resync the data but no success. You should be able to view it as I’ve removed country restrictions.

Well, all of the albums are from the same facebook page with the same restrictions. Why would 1 out of 5 of them show up?

Okay, the albums may not be publicly visible. I was not logged in as admin but as another account which could see the album. When completely logged out I cannot view them either. Is that the issue?

It may have country restriction because the link works for me, Also I’m not logged in to facebook so it’s not just for admin.

I don’t seem to be having the issues anyone else here is having, I can get into my back-end just fine but can’t go to plugins section or update-core section! I’ve cleared DB of all bwp instances and cleared htaccess of it as well. HELP!

Yeah, I thought maybe that too but it wasn’t, I removed all except your above from my .htaccess file but still the same results.

I’ve deleted all db tables and instances and followed your instructions but I can still not get into the plugins section on the backend. Only getting Internal server error. Please… any ideas?