WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing


This malicious code will redirect users coming from social networks like facebook and google+ to an ad page.

Analyzing the files in the installation we discovered that wp-config.php had too open permissions (0666).

The wordpress github repository show that this problem exist since about 2003!

Why is the file saved with 0666 instead of 0600?

There is any practical need?

share|improve this question

The web installer writes configuration data into that file. It needs write access for that.

I don’t think this was your backdoor. There was probably a plugin or an old theme with timthumb that had a vulnerability.

share|improve this answer
I don't know if you have clear what are the permissions granted by 0666, the last 6 means that O can Write and Read the file – Matteo Jan 15 '13 at 8:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.