Esta semana una empresa de host de USA en la que tengo un plan compartido me aviso 2 veces por email que estaban haciendo defacing a blogs con wordpress y me detallaron en los correos instrucciones para poder solucionarlo.
Te pongo un paste de los correos haber si te sirve o tiene algo que ver con lo tuyo.
Los dos fueron seguidos una el dia 9 y otro el 10.
Dia 9
Recently few Sites were hacked on our server due to a poorly written plugin for Word Press - Akismet. Hacking has been made with the help of this script below:
http://***.com/wp-content/plugins/akismet/akismet.php
As a security measure we would request all word press users to update their word press setup and also avoid/uninstall this plugin called - akismet, until a they update it.
As a security measure we recommend word press users to use following plugin -
WordPress › Limit Login Attempts « WordPress Plugins
WordPress › Login LockDown « WordPress Plugins
Regards,
Server Management Team
Dia 10
Security Updates - Attention WordPress webmasters
==================================
Recently a new high risk vulnerability was discovered in the highly popular TimThumb script. TimThumb is a “A small php script for cropping, zooming and resizing web images (jpg, png, gif). Perfect for use on blogs and other applications.“
TimThumb is included in a lot of WordPress plugins and themes (free and paid). Exploiting this vulnerability an attacker can upload and excute a PHP file of his choice on a vulnerable website.
Download the fixed version (v1.34) from the TimThumb project page -
Enlace eliminado
You should upload it where the extra script/library files for your theme are located, overwriting the old one. For example /wp-content/themes/MySuperTheme/script/. Be careful though as this may break your site.
For details refer to -
Enlace eliminado
Regards,
Server Management Team
