Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Today I've got a letter from my hosting provider that admin-ajax.php script had been sending spam until it was blocked. About two thousand spam messages were sent to different emails. I know if you have proper mail function in your functions.php you can simply run the next code from Google Chrome console:

$.ajax({
    type: "POST",
    url: '/wp-admin/admin-ajax.php',
    data: { action: 'mail_function', message: 'test'},
    dataType: "html",
    success: function(data) {

    }
});

Is there another way to do it and any suggestions where I may find vulnerability?


I am using ContactForm7 plugin for userforms

share|improve this question
    
What version of WordPress are you running? I don't see mail_function being a standard action in 3.6 Could you search your code and see if you can find where the code for this is. My bet is in a bad plugin as s_ha_dum said in his answer. –  Mark Davidson Aug 23 '13 at 14:30
    
3.6 version. 'mail_function' is just an example function that could be used by hackers. But I didn't found even a standard php mail function in my theme. –  Pavel K Aug 23 '13 at 16:22
    
Based on the answers you have been given and the wording of your question I have no idea what your asking. Stop being hypothetical and just ask a question. –  Chris_O Aug 24 '13 at 7:08

2 Answers 2

This is why you use nonces.

$.ajax({
    type: "POST",
    url: '/wp-admin/admin-ajax.php',
    data: { action: 'mail_function', message: 'test', _nonce: <?php echo wp_create_nonce( 'mail_function_' . $post->ID ) ?>},
    dataType: "html",
    success: function(data) {
    }
});

Then in your PHP function:

function my_ajax_mailer() {
    if ( ! wp_verify_nonce( $_REQUEST['_nonce'], 'mail_function_' . $post->ID ) )
        return;
    // send mail...
}
share|improve this answer
    
I don't have mail_function so don't use nonces, Contact Form 7 plugin is enough for my goals –  Pavel K Aug 23 '13 at 16:30
    
Well then you have been hacked. –  Chris_O Aug 23 '13 at 16:31
    
No, ContactForm7 plugin out of a box generates nonce field <input type="hidden" value="2a37a6adb1" name="_wpnonce"></input> –  Pavel K Aug 23 '13 at 18:47

admin-ajax.php by itself should not be a problem, but a poorly written function hooked to into the AJAX API could be trouble. I suspect that is what you've got. Your "proper mail function" isn't really as proper as you think and it is happily sending any email from any source.

Or your site has been hacked at some deeper level or you've got a rouge plugin installed. Based on the information provided, it is hard to say.

share|improve this answer
    
'mail_function' is just an example of hooked function, not presenting in the functions.php. I searched through theme files by "mail" and "eval" keywords and didn't get anything similar. –  Pavel K Aug 23 '13 at 16:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.