Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin.

define( 'DISALLOW_FILE_EDIT', true );
define( 'DISALLOW_FILE_MODS', true );

Yet lately I've noticed strange plugins & themes being installed on my demo site. I can see in the apache logs that they've been trying to access plugin-install.php but failing with a 500 error.

The folder permissions are 755 on both plugins & themes, so the files can execute but only the user has write access.

Does anyone know how they might be doing it / where I'm going wrong?

Thanks

share|improve this question
    
If you would post a couple of the full log entries it would help. I suspect this is a bot trying to get access to the site-- just a guess. –  s_ha_dum Jan 28 '13 at 19:42
    
Seems my host only keeps the apache logs for a day :| –  user1958047 Jan 29 '13 at 11:51
    
Basically, requests were made to plugin-install.php and failing with 500 error... yet the plugins made it through. Could another plugin allow them to install a plugin on WordPress? –  user1958047 Jan 29 '13 at 11:53
1  
Your description worries me, especially the part about the plugin making it through. It sounds like you have a security problem but I don't know that it can be solved in this venue. –  s_ha_dum Jan 29 '13 at 14:20
    
Perhaps your WordPress security are being overwritten from your cPanel or your panel (if not using cPanel). This sounds more like a problem with your hosting company. Why not contact them and explain the issue? –  denis.stoyanov Jul 28 at 8:30

1 Answer 1

The behaviour is indicatory of a compromised website.

Check your site for malwares or hacks.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.