• Had 4 $10 donations today with name “Attacker” and email “a1788102185@example.com” where the username on the email is a random string beginning with “a”. Also the description was “Donated to PoC” which i assume is Proof of concept? So this is either a white hat warning me of an exploit or something worse. I updated to latest version, so will that update automatically remove any payloads from the database? Should i delete the create user accounts even though they supposedly have to capabilities? or at least wait until I hear back fro msupport because honestly, this plugin has added over 100 users to my databse since the last update that enabled that b.s. without any way to disable. Honestly going to look for another plugin or just use a direct stripe or paypal link.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Support Ginger Coolidge

    (@gscoolidge)

    Hello @crazywhistlepig,

    Glad you reached out, happy to help.

    What you are experiencing is what we call “donor spam.” This can happen for a wide variety of reasons, and it is sadly very common across all donation platforms, not just GiveWP.

    We have a list of recommendations to help prevent donor spam that I’ll be happy to share if you can reply with a link to your donation form. The remedies vary based on your donation form version.

    We look forward to guiding you to a solution here! 🙂

    i am getting 100s of failed transaction and few successfull transactions with $2, how can i stop this?
    I am using stripe payment gateway.

    @crazywhistlepig did you find solution to your issue?
    @gscoolidge i have to deactivate the plugin, what should I do to keep this plugin active on my site? any suggestion will be great. cheers

    Plugin Support Ginger Coolidge

    (@gscoolidge)

    Hello all,

    I will share the recommendations which differ slightly depending on which donation format you both are using.

    Set a higher minimum donation amount

    Sometimes, simply increasing the minimum donation amount is a huge method of preventing these types of attacks. Bots tend to test forms with $1 or up to $5 amounts. If your form only accepts donations of $10 or higher you can prevent these low-hanging easy bots.

    Implement Cloudflare Turnstile

    If you are using the latest donation format in the visual form builder, we’ve built a free anti-spam feature specifically for them with the Cloudflare Turnstile plugin: https://wordpress.org/plugins/give-cloudflare-turnstile/

    You can see how to set things up for it here:
    https://www.liquidweb.com/help-docs/software/give/cloudflare-turnstile/

    ========================================

    Add our reCAPTCHA code snippet

    If you are still using the legacy or option-based donation forms, we have a code snippet that will add a v2 reCAPTCHA to the bottom of every donation form automatically. Read the instructions within the code snippet comments to make sure your reCAPTCHA keys are entered correctly.

    https://github.com/impress-org/givewp-snippet-library/blob/master/form-customizations/implement-recaptcha.php

    We recommend adding PHP code snippets to your website via a code snippet plugin. We use this one https://wordpress.org/plugins/code-snippets/, however, there are many available that can work.

    Please note that this code snippet is provided as an example of how you can extend GiveWP with code. It’s up to you to implement and customize to your liking. We cannot provide support for custom code on your website, only the code that we create and distribute.

    ========================================

    Most of the time one or more of these options are successful. If however, you are still experiencing donor spam, there are a plugins (some paid) like: https://wordpress.org/plugins/zero-spam/.

    They offer excellent support and are pros at managing the ins and outs of stopping spam.

    I hope this helps to guide you in the right direction!

    Have a great rest of your day 🙂

    I think i might have found a possible reason why the attacker in this case was able to do what the OP said. Is there an email address I could email the details? i don’t want to post it here. Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.