Suspicious Admin User in WordPress

Discussion in 'Blogging' started by passionate_rohan, May 1, 2013.

0
  1. #1
    Hello Friends,

    I have a WordPress blog where I have disabled the user-registration option so that no external user can register on my blog. Moreover, I have removed the registration forms from every possible page/post/widget.

    I never shared my password with anyone and am the only person to handle the blog. Recently I was surprised when a new user with the name "AdminAdmin" was created externally. I am not sure how this was created, maybe through some direct URL database insertion. So, I have deleted the user and made my blog more secure.

    Please be aware that recently WordPress sites have been mass attacked and compromised through automated bots. (Source: BBC, HostGator, CloudFlare).

    So keep an eye open if you find any suspicious user in your blog. This could be the start of something much worse.


    It will be great if someone can throw light on this suspicious user creation.


    Thanks.
     
    passionate_rohan, May 1, 2013 IP
  2. themes4all

    themes4all Well-Known Member

    Messages:
    662
    Likes Received:
    47
    Best Answers:
    6
    Trophy Points:
    100
    #2
    in fact this is the last Exploit found : http://www.cvedetails.com/cve/CVE-2012-6527/

    Concerning your problem i think it was an old Vulnerabilities in wordpress 2.x but the best way to secure your wordpress is :
    - using a complex mysql prefix
    - make the files wp-config and htaccess 444
    - Create a new admin user and remove the default one
    - Password Protect Your WordPress Admin (wp-admin) Directory : Link

    Goodluck!
     
    themes4all, May 1, 2013 IP
  3. passionate_rohan

    passionate_rohan Well-Known Member

    Messages:
    560
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    121
    #3

    Thanks for the reply. But I guess this is some other issue yet quite similar to the one you mentioned.
    This is mainly because I am running the latest version of Wordpress v3.5.1 with additional plugins like WP-antivirus and secure-WP.

    I have the same set of plugins on 3-4 different blogs but the problem came only on this one which has the negligible traffic.

    Either the old WP bug has flared up in new version, or the botnets have found a new way to web inject their data.
     
    passionate_rohan, May 1, 2013 IP
  4. wendallb

    wendallb Active Member

    Messages:
    180
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    78
    #4
    Thanks for the tips, will keep a watchful eye out for that.
     
    wendallb, May 1, 2013 IP
  5. themes4all

    themes4all Well-Known Member

    Messages:
    662
    Likes Received:
    47
    Best Answers:
    6
    Trophy Points:
    100
    #5
    I also the latest wordpress and keep an eye on updates but as we all know every CMS have a Negative part and sometimes we get some Codes that we don't know where the Hell the Came Out :) at all for one we have always to use the Minimum of Plugins.. and concerning the :
    They don't slow down your website!!? in fact i just use them, make the necessary changes then i keep a copy of my Htaccess .. then i Remove them! because i notice that they use a lot of Bandwidth !
     
    themes4all, May 1, 2013 IP