Was my plugin hacked?

  • Resolved Grackle Design

    (@mikedark)


    11 years, 11 months ago

    I just installed the WordFence security plugin and it came back with warnings for 3 files in the lightbox pop plugin. The files are:

    lightbox-pop/admin/create.php
    lightbox-pop/admin/install.php
    lightbox-pop/admin/lightbox-key.php

    Each of the warnings say the following:

    “This file may contain malicious executable code
    This file is a PHP executable file and contains an eval() function and base64() decoding function on the same line. This is a common technique used by hackers to hide and execute code. If you know about this file you can choose to ignore it to exclude it from future scans.”

    Is this normal for this plugin, or is it indicative of malware?

    thanks in advance

    https://wordpress.org/plugins/lightbox-pop/

Viewing 7 replies - 1 through 7 (of 7 total)
  • BenSucuri

    (@rngdmstr)

    11 years, 10 months ago

    I took a look at the lightbox-pop plugin (latest version – which one are you running?) and it doesn’t seem to have these two files:

    lightbox-pop/admin/create.php
    lightbox-pop/admin/lightbox-key.php

    So it’s probably safe to say they are not supposed to be there.

    Now, I would suggest opening up that install.php file in a text editor (don’t execute it!) in the /admin directory and take a look at the code.

    If it doesn’t look like this then it is infected:
    http://pastebin.sucuri.net/8h64jl

    The easiest way to fix this problem would just be to delete those plugin files and replace them with fresh copies 🙂

    There might be a backdoor somewhere in your site, too, so it would be prudent to replace your core WordPress files just in case, and make sure to change all passwords associated with your website.

    Thread Starter Grackle Design

    (@mikedark)

    11 years, 10 months ago

    sorry forgot to update. yes, the plugin had been injected with malware and contained extra code and files that were not in the original plugin

    Plugin Author f1logic

    (@f1logic)

    11 years, 10 months ago

    hi mike
    those files are present in premium version.
    and it is not an issue. those files are safe

    WhiteFury1200

    (@whitefury1200)

    11 years, 3 months ago

    Hi there,

    I Also got the three warnings regarding the following –

    This file may contain malicious executable code: /public_html/wp-content/plugins/xyz-wp-popup/admin/create.php

    Filename: wp-content/plugins/xyz-wp-popup/admin/create.php
    File type: Not a core, theme or plugin file.
    Issue first detected: 10 hours 36 mins ago.
    Severity: Critical
    Status New

    This file may contain malicious executable code: /public_html/wp-content/plugins/xyz-wp-popup/admin/manage.php

    Filename: wp-content/plugins/xyz-wp-popup/admin/manage.php
    File type: Not a core, theme or plugin file.
    Issue first detected: 10 hours 36 mins ago.
    Severity: Critical
    Status New

    This file may contain malicious executable code: /public_html/wp-content/plugins/xyz-wp-popup/admin/xyz-wp-popup-key.php

    Filename: wp-content/plugins/xyz-wp-popup/admin/xyz-wp-popup-key.php
    File type: Not a core, theme or plugin file.
    Issue first detected: 10 hours 36 mins ago.
    Severity: Critical
    Status New

    WhiteFury1200

    (@whitefury1200)

    11 years, 3 months ago

    Then, After I activated using the purchase Key, I this warning,

    WordPress core file modified: wp-settings.php

    Filename: wp-settings.php
    File type: Core
    Issue first detected: 10 hours 54 mins ago.
    Severity: Critical
    Status New

    WhiteFury1200

    (@whitefury1200)

    11 years, 3 months ago

    Really like the plugin and would like to solve the issues, as I think it looks great.

    ERROR WITH LICENSE KEY – WP 4.1 – I since updated the core files to 4.1, but now the License Key activation will not work. The Core WP warning has now gone, but the three other warnings are still there.

    I tried to contact support and log a ticket there through the members area, but I am locked out?, advises that my account does not exsist?, tired to reset password and also no luck? Purchased plugin yesterday, not sure what the issue is.

    Have sent a email to support, but if you could kindly please advise what I should do would be great.

    Plugin Author f1logic

    (@f1logic)

    11 years, 3 months ago

    hi these are not malicious codes
    i believe you have already received response from support

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Was my plugin hacked?’ is closed to new replies.

Tags