0

0

Recently from few days , i'm facing a problem with wordpress admin login on my site. My wp-admin password is changing automatically after 3-4 hours. when i try to reset my password it dont sent mail to registerd mail . In recent days , i just installed a wordpress plugin this plugin (used for copy paste across websites). And i opened some few msgs , which i recieved through contact form, All were Promotional msgs. I'm unable to find find any solution for this problem .

My website is hosted on aws server and i'm using mysql database. All the plugins i'm using on my wordpress site have big number of installations.

How can i identify , why this is happening and how can i be safe from this problem

1 Answer 1

0

Do you use elementor? It could be this:

"The critical-severity flaw is tracked as CVE-2023-32243 and impacts Essential Addons for Elementor versions 5.4.0 to 5.7.1, allowing unauthenticated attackers to arbitrarily reset the passwords of administrator accounts and assume control of the websites." https://www.bleepingcomputer.com/news/security/hackers-target-vulnerable-wordpress-elementor-plugin-after-poc-released/amp

4
  • how can i remove that malicious script from the wordpress website . May 20, 2023 at 2:15
  • I would write down all plugins that are active, then delete (or rename) the plugins folder. Then re-download/install all plugins from the WP repository. Existing settings should be retained in the options database - but that might also be where bad settings are stored, so you might have to manually look at the latest options. Make sure PHP is at 8.2. Make sure WP core is updated to 6.2.2. Then manually look at all files - like ICO files that are really PHP obfuscated code. Don't have a user named 'admin' - create a new admin-level, then log in as that new account and delete old one. May 21, 2023 at 1:34
  • ...and look for other user accounts that shouldn't be there. That is one way that the hacker can exploit the non-patched Elementor plugin. May 21, 2023 at 1:37
  • thx @RickHellewell , i successfully removed the files malicious files and restored the file which was modified for the attack , i downloaded the wordfence , May 21, 2023 at 16:53

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .