bcmedia

Hi Keith

I don’t think your plugin was the source of the hack & after closer inspection it transpires the hack had a trigger which injected the DB after I cleaned it.

The only fix was to rebuild the website as the back ups were all compromised.

Thank you for your patience.

Craig

Hi Keith

Thank you for the response – apologies I didn’t mean to be so blunt sounding (this is maybe the 100th email/message I’ve written today, such is modern life).

There was an ajax.php file in the root plus the files mentioned above which were compromised. When I looked through Stop Spammer I noted this as well – https://s10.postimg.org/5do0w94jt/keith_breach.jpg

Initially no scans noticed anything. It was when I did a site: index check on Google I noticed a lot of spam pages such as https://s10.postimg.org/5ri6vuyzt/image.png

I was quite perplexed when the hosting company suggested the plugin was the cause! But I felt it was worth highlighting incase it was an issue you may have previously encountered.

Last thing, I’ve got the compromised files if you would want to review them. I’ve hopefully removed them from the live site but I’ve got archived copies.

I suppose the last point worth noting is that the site was updated to 4.6 about 2 months ago.

Kind Regards
Craig