Hi markf1,
If this new admin user was not created by you or any other admin users on your website, then I’m afraid to tell that your website was hacked, although what you did so far by deleting this user is a good thing, but I recommend following these steps mentioned in “How to Clean a Hacked WordPress Site using Wordfence” article.
It’s possible that there was a vulnerable/outdated plugin or theme on your website that someone exploited it and managed to create this user, or any of your FTP/Dashboard credentials were compromised and in this case I suggest securing your working environment.
Let me know if you have any further question,
Thanks.
Thread Starter
markf1
(@markf1)
Hi and thanks for your reply. I was able to pretty conclusively determine that the site owners log in credentials were hacked. It does not appear after several different scans including a WordFence scan that any malicious code or etc was added. I caught it in time thanks to the WordFence alert I got. I had done a full offline backup of the site a few days prior to this event (got lucky) so I have that to fall back on.
To recap, an unknown person logged in using the site owners credentials. That unknown person changed the site owners user email address, created a new user admin account and removed the WordFence plug in. I got an email that a username I did not recognize had logged into the WordPress dashboard. I checked it out and was able to delete the new user, delete the hacked user, and run several site scans,and re-install WordFence.
@markf1 – there is a plugin named Delete All Comments that was compromised. It has since been removed from the WP repositories, but the mainwall.org domain is associated with the hack. If you still have that plugin installed you need to delete it or you will just get hit again.
@wfalaa – unless you guys manually added that plugin to your detection list, nothing in the code would trigger a WF alert. You might want to do so. There is another fake plugin that gets added wp-spam-shield-pro that posts data to mainwall.org letting the hackers know they’ve infected another site.
-Michael
Thread Starter
markf1
(@markf1)
Michael,
Thank you so much! The site in question did indeed have the Delete All Comments plug in installed. I have removed it.
Thanks again!
Hi Michael,
Thanks for your input, I want to confirm that our team has already added a specific rule to the firewall protecting from “Delete all comments” plugin vulnerability, knowing that the community version of the firewall rules will include this rule after 30 days, check this link for more information.
Thanks.
@wfalaa I wasn’t actually referring to the firewall, I meant the scan. This infection is already in the wild and the plugin in question was compromised at the end of September, I believe, and I don’t think it was pulled from the repositories until a little over a week ago.
-Michael
