karelnet

@marc77 Yes I have different MySQL passwords for websites. But all DB are on the same server. I’d find strange they could have access to all databases with different usernames/pass from one site ?
To be sure, I changed the root password…

I can confirm that some of my sites were hacked even without Advanced Access Manager.

@marc77 Nope.

I had 20+ websites infected. Are some of you using InfiniteWP ?

So as far as I know, it uses and url injection like /wp-admin/admin-ajax.php?action=fs_set_db_option to change home option.

This particular one seems to be blocked by Wordfence, but some others may not.

I think I found a suspect IP :
2a07:5741:0:140::1

Was trying something like (not real URL):
https://[XXXXXX].org/wp-admin/admin-ajax.php?%5Bobfuscated%5D=home&option_value=https%3A%2F%2Fjs.wiilberedmodels.com%2Fsample%3Fd%3D1

I had this problem on websites that do not have Advanced Access Manager plugin and with no user created.

Hi

It happened to me. I cleaned up but it came again one day later, even websites with last version of WP, with Wordfence, Block Bad Queries, etc.
Does somene knows where it comes from ? Is it an injection ?

OK there are no more JS errors. Still not working :
https://divine-et-feminine.com/v2/panier/

Thanks for your help

I understand and I’m thankful you take time to investigate on my problem.
I have set the “modal” option to true (working)

By the way, if you could tell me how it is supposed to work (e.g. : should there be a form tag when in plain page ? Or a JS function somewhere ?) I could try on my own.

Thank you for your reply.
The problem doesn’t seem to be related to the javascript error you noticed (it was not a blocking one). I desactivated the plugin that was making this error but the problem is still here.
I also checked the option to dequeue bootstrap JS, no effect.

Same problem here.
Everything looks fine and even if payments are made and we go back to the site, status is “no payment for this submission…”

Plugin 1.2
WP 4.5.4
CF7 4.5
PHP 5.6.5

Yeah, this is our fault that Shareaholic got some money showing ads to our visitors.

I can’t believe it ! Are you serious ?
“It is likely that there were monetization settings that had been left turned on during your initial setup that would have caused ads to show up.”

If monetization was “accidentally” set on, I should have an account somewhere, right ? I don’t. I should have earned money or something ? OK, where is it then ? I don’t want to get money from my visitor this way.

YOU have earned money showing ads to my visitors. You apologize, but you keep it.

Same here ! What a shame !
This thing is a spyware/adware

Should be removed from www.ads-software.com directory !
Is there is a way to report this abuse ?

OK I found the problem.

Here is how to fix it :

IN FILE \wp-e-commerce\wpsc-core\js\wp-e-commerce.js

FIND :
var dropdowns = jQuery(this).closest(‘form’).find(‘.wpsc_select_variation’);

REPLACE BY :
var dropdowns = jQuery(this).closest(‘form’).find(‘.select_wrapper.wpsc_select_variation, .colors.wpsc_select_variation’);

FIND :
if(t.val() <= 0){

REPLACE BY :
var radiosSelected = t.find(‘:radio:checked’);
if(!radiosSelected.length){

—-
Actually this means going back to previous version of the file wp-e-commerce.js

Hope this helps.