Title: SECURITY ISSUE Last modified: February 24, 2021 --- # SECURITY ISSUE * [aewing2021](https://wordpress.org/support/users/aewing2021/) * (@aewing2021) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/) * Today we’ve had 4 websites maliciously hacked with an injection of wp-stream. php into WP core and uploads folder. The only common denominator is QuadMenu plugin. * Please can you look into any potential security backdoors ASAP. Viewing 12 replies - 1 through 12 (of 12 total) * [cordi](https://wordpress.org/support/users/cordi/) * (@cordi) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14088985) * We have the same Problem 🙁 * [arjean](https://wordpress.org/support/users/arjean/) * (@arjean) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14089145) * I can confirm that 2.0.6 got hacked. I am not sure about 2.0.7 though. * From their release log it seems that a security issue got fixed: 2.0.7 * Fixed. security issues * [@aewing2021](https://wordpress.org/support/users/aewing2021/) & [@cordi](https://wordpress.org/support/users/cordi/) what versions do you use? * Will deactivate the plugin for now. * Thread Starter [aewing2021](https://wordpress.org/support/users/aewing2021/) * (@aewing2021) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14089402) * I can confirm that this related to patching to 2.07 version and that the issue is resolved with the latest update as far as we can see. * We had to do full back-up restores, although so far as we could see the injection was into the file structure as opposed to the database. * I would urge anyone to update all their sites running QuadMenu to 2.07 immediately. The security backdoor can still be exploited even if the plugin is installed but deactivated. * A software update should suffice and mean no deactivation is necessary. * Hopefully, that helps anyone else reading this who has experienced this issue. - This reply was modified 5 years, 3 months ago by [aewing2021](https://wordpress.org/support/users/aewing2021/). * [valhard](https://wordpress.org/support/users/valhard/) * (@valhard) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14091098) * We have several websites with QuadMenu hacked (with some sort of domain redirect malware) yesterday! * [dougp2021](https://wordpress.org/support/users/dougp2021/) * (@dougp2021) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14091257) * Think our site fell victim to the quad menu issue. Was going to update the Quad menu via the WP-admin site but mine looks like this: Any ideas? * ``` /** * Dashboard Administration Screen * * @package WordPress * @subpackage Administration */ /** Load WordPress Bootstrap */ require_once __DIR__ . '/admin.php'; /** Load WordPress dashboard API */ require_once ABSPATH . 'wp-admin/includes/dashboard.php'; wp_dashboard_setup(); wp_enqueue_script( 'dashboard' ); if ( current_user_can( 'install_plugins' ) ) { wp_enqueue_script( 'plugin-install' ); wp_enqueue_script( 'updates' ); } if ( current_user_can( 'upload_files' ) ) { wp_enqueue_script( 'media-upload' ); } add_thickbox(); if ( wp_is_mobile() ) { wp_enqueue_script( 'jquery-touch-punch' ); } $title = __( 'Dashboard' ); $parent_file = 'index.php'; $help = ' ' . __( 'Welcome to your WordPress Dashboard! This is the screen you will see when you log in to your site, and gives you access to all the site management features of WordPress. You can get help for any screen by clicking the Help tab above the screen title.' ) . ' '; $screen = get_current_screen(); $screen->add_help_tab( array( 'id' => 'overview', 'title' => __( 'Overview' ), 'content' => $help, ) ); // Help tabs. $help = ' ``` * Thread Starter [aewing2021](https://wordpress.org/support/users/aewing2021/) * (@aewing2021) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14091586) * Yes, this was the same hack [@valhard](https://wordpress.org/support/users/valhard/)– redirect malware. Our sites were hit between 12pm and 4pm UK time. * [@dougp2021](https://wordpress.org/support/users/dougp2021/) – do a backup restore before updating the plugin. If you don’t have one then do a fresh WP core install and check the uploads folder for wp-stream.php and _lcl file – ours were in the root oof the uploads folder. There was also an injection in the WP root index. php file. * [Ilias Antonopoulos](https://wordpress.org/support/users/elias69/) * (@elias69) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14092097) * Same problem here. 2 sites hacked. wp-stream.php present. Code injection to many files. * Restore from backup. Update Quad Menu. Problem solved. * I have to admit that Quad menu developers responded quickly to release an update. - This reply was modified 5 years, 3 months ago by [Ilias Antonopoulos](https://wordpress.org/support/users/elias69/). Reason: wp-steam.php -> wp-stream.php * [wm123](https://wordpress.org/support/users/wm123/) * (@wm123) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14093452) * Same here, 11 sites hacked yesterday. Restore the backup but hacked again this morning. Please confirmation that the problem is been solved. * [RK](https://wordpress.org/support/users/rjkabra/) * (@rjkabra) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14094444) * Guess we all were attacked almost same time. Would like to understand few things here to clear future such issues and attacks. * 1. Has the quadmenu update fixed the issue completely? 2. How does any hacker understand which all sites uses quadmenu in there wordpress, it there some like google search or ping to check that. Coz if so then all that kind of checks needs to be blocked to somewhat save us in future. * [misterpo](https://wordpress.org/support/users/misterpo/) * (@misterpo) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14096154) * It might be useful to block requests to wp-stream.php to prevent future attacks. * Exemple for Nginx proxy below : * ## block wp-stream.php requests location = /wp-stream.php { deny all; } location = /wp-content/uploads/wp-stream.php { deny all; } * [bresson](https://wordpress.org/support/users/bresson/) * (@bresson) * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14096537) * Yep, same here. 4 sites hacked with the exact signature described by other user * Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/) * (@sterndata) * Volunteer Forum Moderator * [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14096691) * As the plugin has been updated, I’m closing the topic. Please update to get the latest. If you need help cleaning a hacked site, please start your own topic in the “Fixing WordPress” section of the forums. Viewing 12 replies - 1 through 12 (of 12 total) The topic ‘SECURITY ISSUE’ is closed to new replies. * ![](https://ps.w.org/quadmenu/assets/icon-256x256.jpg?rev=2916917) * [QuadMenu - Mega Menu](https://wordpress.org/plugins/quadmenu/) * [Frequently Asked Questions](https://wordpress.org/plugins/quadmenu/#faq) * [Support Threads](https://wordpress.org/support/plugin/quadmenu/) * [Active Topics](https://wordpress.org/support/plugin/quadmenu/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/quadmenu/unresolved/) * [Reviews](https://wordpress.org/support/plugin/quadmenu/reviews/) * 12 replies * 10 participants * Last reply from: [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/) * Last activity: [5 years, 3 months ago](https://wordpress.org/support/topic/security-issue-115/#post-14096691) * Status: not resolved