WordPress.org

Ready to get started?Download WordPress

Forums

Spam received and sent via contact form (9 posts)

  1. -P-
    Member
    Posted 8 years ago #

    I host several domains and past few days some of these domains have received multiple spam emails sent via site contact form. The sender address is always something random like charlie234@domain.com. Adding extra required fields to the contact form does not prevent these spams.

    I run sites with WordPress and Textpattern and same thing has happened with both so it is not platform dependat vulnerability.

  2. Mark (podz)
    Support Maven
    Posted 8 years ago #

    First thing to do is delete the contact forms.
    Then find out if they were the latest code
    Then let the authors know
    But....
    If this happening on other sites, you will need to talk to your host. Also check each and every directory you have for any files you did not put there. And if you find anything, download it then delete it.

  3. -P-
    Member
    Posted 8 years ago #

    Yes, I disabled all the contact forms at the moment. Installations with Textpattern were using the latest release, installations with WordPress the old version of Ryan Duffs contact-plugin. I upgraded all the WP installations to use Contact Form ][ (WP-1.5.x). It has subject field to prevent this kind of malicious use but this spam in question can assumably also bypass that see discussion here. And it has happened to other people too, see this message.
    I did inform my host too.

  4. nmallory
    Member
    Posted 8 years ago #

    This is the problem I am/was happening. I thought maybe it was wp-email. I was using old versions of wp-email and the contact form. I've upgraded both on one of the websites it was occurring on. Hopefully that will resolve it.

  5. -P-
    Member
    Posted 8 years ago #

    I just received email from my ISP telling that during past few days it´s been more than 20.000 spam emails that have been sent from my server using this contact form vulnerability. So this is really serious security problem.

    Some additional required fields in the contact form won´t help. For now, I´ve disabled all the contact forms from my WP installations. I hope this is taken seriously and something will be done.

  6. lawtai
    Member
    Posted 8 years ago #

    Yep, this is what I was experiencing from my website as well. I took down my contact for too. Hopefully there's a solution for this...

  7. Lester Chan
    Member
    Posted 8 years ago #

    nmallory: wp-email there is interval between each mail send which u can specify for each IP, and there is logging feature for every successfully/failed email. And it uses phpmailer which is the best mailer software outthere and I think in phpmailer itself there is also another secruity feature.

  8. Direkt
    Member
    Posted 8 years ago #

    If your being hijacked, you're going to want to use referrer or host checks. If it's the script that has a hole in it, I recommend either getting rid of it, or patching it up yourself.

  9. Bhoney
    Member
    Posted 8 years ago #

    I got one spam e-mail via my contact form and immediately came here for advice and was told to get Bad Behavior.Since then, I have not had one spam comment sent to me via my contact form.

Topic Closed

This topic has been closed to new replies.

About this Topic