That’s fine but I assure you, it has nothing to do with the code in this plugin. It’s simply not possible, not unless the plugin code was modified after it was installed on your site, which could only happen if your site was already compromised.
I can pretty much guarantee you that the exact same thing would have happened if you had been using the default wp-login.php login form. Why? Because your site was already infected with malicious code that simply attached to the core WordPress login process.
It would not have mattered which login plugin you used, it just happened that you used the same one both times, so it made logical sense that it was this plugin.
I’d recommend you run the Sucurri scanner on your site to look for malware: http://sucuri.net/
Thank you.. I did scan my site (http://www.blissfulinterfaces.com) with http://sucuri.net/, just a couple of hours earlier (just to make sure) and it came out 100% clean. I understand that there could have been something in my site even sucuri didn’t pick. If there is, it only gets it’s way with sidebar login. Not wordpress default login.
@thanushka Please listen for a moment: there is no way Sidebar Login is responsible for this. It would have happened no matter what plugin you used.
I’m in no way affiliated with this plugin, I just want to help clarify this issue for you and everyone else.
@thanushka Please listen for a moment: there is no way Sidebar Login is responsible for this. It would have happened no matter what plugin you used.
Well it didn’t. It only happened with sidebar login and it happend 3 times not just once. Every time it happened, I removed the plugin, completely changed all my passwords, cleaned up the server, wp-config, and freshly installed WordPress the problem solved.
My review is completely based on my experience.
I understand it is based on your experience, but (as someone who handles dozens of support tickets every day) I can tell you that a large percentage of the time problems like this only seem to be related to the plugin.
As a developer, I could very easily write a “hack” that would intercept the login credentials of any WP login plugin. It’s really quite easy. The only thing that has to happen is the hack needs to get installed on your site. Simple as that.
FYI, this might be related to this post, which has apparently been addressed:
http://wordpress.org/support/topic/security-flaw?replies=18#post-3979284
2.5.0 has just been uploaded and fixes the issue.
I don’t see how a login plugin would do this. For the most part it simply uses wp_login_form. Has to be a co-incidence. If de-activating Sidebar Login is the only action you have taken since your hack, I hope you’ll be big enough to come back here and let us all know next time you are hacked without it.
Look, I didn’t come here to argue with you guys but to report a problem I clearly see. I’m NOT saying that the plugin itself hacks. BUT it’s clear to me that it has security holes that let hackers get their way in. I don’t know how since I’m not a developer. That’s why I came here and posted this. To make something better you need to know both good AND the bad, and that’s what a reviews are for.
I see that there really WAS a issue with the way username and password are handled and the plugin contributor was nice to fix it. (http://wordpress.org/support/topic/security-flaw?replies=18#post-3979284).
By the way I will never use this plugin again. I was just trying to help you guys fix a potential issue.
It works great now… May I call you Tha?
I was frustrated too but that’s how free open source software sometimes goes. I’m guessing you and I both stumbled across this plugin because we needed a solution. This is the solution we found. The developer provided this for free. He even rewrote it with little or no notice to fix the problems we encountered.
I understand where you’re coming from but this plugin was great before and the problem has been fixed.
^ to add, even with this problem which could potentially log requests – ask yourself how somebody would access those logs..? My point is, even without sidebar login, your server is clearly vulnerable to attack and needs a thorough audit or its just a matter of time before it happens again 🙂
@gokevgo: He he, You can call me Nush. I do understand that contrary to how people think no one owes anyone anything (lol)…
mikejolley: I’m glad to hear the password issue is fixed (thank you so much for that). This plugin really is the best login plugin I’ve seen (by both looks and features). That’s why I installed it 3 times lol
I do think there could be something else on my site related to the hacks. I think some script was already running trying to grab the passwords looking for a way in..? (because my hacking always happened after asking to log in twice or more, and only if I loged in through the plugin..) I’m cleaning up everything and also having my server checked now. I will update here when I find anything.
I’ve seen many different ways that something like that could “work” — as in, a number of ways a bad person could exploit the Internets to take advantage of your info…
“Man in the middle” have to do with DNS or even bookmarks that you’ve saved to the wrong URL — or someone who is grabbing your logins, then redirecting you to an error page (every time), so you can legitimately log in again (that would explain the double-login). If that’s the case, the double-login is a symptom / sign of the compromise, not necessarily a plugin flaw.
Another thing to be careful of — if you’re hosting any other type of live chat or PHP-based solution, PHP can be exploited if your PHP ownership on the server is the same as the Apache user. In other words, common ways of changing your code might include someone using an “include” to execute their nefarious code from their library on another site. WordPress has always appeared solid in this regard, but I give the files ownership to a user that can’t be modified by Apache (so you have to be SSH-ed in to make changes). Not all software is as include-preventative or sturdy. This is a real-world example I’ve seen a number of times with non-WordPress addons (like a Live-chat that’s hosted on the same server). WordPress is pretty solid, but it’s only as solid as the least secure thing you’re running on the same box.
There are all sorts of other things that can go wrong for you, depending on how locked down you are. SQL injection where someone can change the parameters of the redirect… or other symptoms you mentioned before.
IMHO, it’s entirely possible that your problems here had little or nothing to do with the exploitability (is that even a word) of this plugin — but it’s tough to deny the coincidental timing.
My unsolicited advice to you — find someone you trust who has a tendency to be a security nut — or if you’re savvy to do so yourself… check your logs and code to see any trace of what someone might have done. Lock down your iptables setup, lock down the log permissions (if others have SSH access to your server). Block external access to any services like MySQL that likely don’t need to be accessed externally. It’ll be a lot of “security nut 101” type of stuff, but that will ultimately help you sleep better at night and reduce the chances of anyone getting in. Lastly, run SSH on a non-standard port and turn off password authentication. I get thousands of people weekly trying to port scan my servers and brute-force. It’s possible that someone got in by *GUESSING* a password. I run hostkey-only with a password-protected hostkey just because I’m a nut like that.
The above statements assume you haven’t locked down the server to the “nutty extent” (don’t feel bad, many don’t)… and it also assumes you’re running some Linux variant (isn’t everyone?) 🙂
