Being hacked. Is there a list of Wordpress security holes I can check against?

Question

I observe a file being uploaded into various plugin folders in my Wordpress site. The file is used to send out spam from my server and every time I remove it it gets uploaded to another folder. There are hundreds of IP addresses accessing the file, so blocking them may not really prove useful if the attackers have a huge pool of IP addresses.

However, I have another two sites that use platforms other than Wordpress and they are not being hacked (there are no malicious files uploaded to those folders) so this makes me think that the attackers may be relying on known folder structure of the wordpress plugins to upload their file. The user on the uploaded file is my webserver user [and the name is quite unique], so that also makes me think the hack is performed through http and not through ssh.

I know that Wordpress in itself is more or less secure and that the poorly coded plugins are usually what creates security holes. So is there possibly a resource online where those security holes for wordpress are cataloged and I can check if any of my plugins are on the list of "insecure" ones?

Any suggestions in this area are very appreciated.

Answer 1

That's very sad that you are experiencing this problem.

You can do the following things to solve the problem :

1. Check every folder for a list of known backdoors such as C99.php, C100.php, Weevely.php. (You can do that by grep). And delete anything suspicious.
2. Download WPSCAN and run it against your website to see if any known vulnerabilities are present in your website.
3. If you are using any nulled plugins or themes. Delete them as soon as possibl.
4. Keep your plugins and themes up to date even if you are not using them.
5. Always keep a regular backup so that you can restore your website.

I hope my tips help you. And remember, about the known file structure of your website, Security is always better than obscurity. It doesn't matter if you have a known file structure until everything you are using is safe.

Cheers!