crose13

I run security and before kmessinger said anything, I’d already read all of those articles. I’d just done a redesign and always clean out my whole server between redesigner. I am familiar with Sucuri Site Check and run it as often as I run Malwarebytes on my physical machine. It was checked and fine BEFORE the plugin install, but not after. If my server was compromised, wouldn’t it affect ALL of my domains and subdomains because it only effected the one I’d just installed the plugin on?

I do understand Esmi’s position, I just didn’t appreciate being treated like I’m intentionally badmouthing a plugin I’ve used before and appreciated. I also did not retract my statement and don’t appreciate words being put in my mouth. I would have loved to have had an opportunity to say how much I do love the plugin but the WordPress plugin page DID redirect me to a scareware site. My OWN site did not send me to scareware or spam. THAT plugin page did. I did my best to alert the proper authorities to fix it. I know that the plugin would never intentionally hijack my site, but I do feel it or its source was compromised.

My site was perfectly fine before the plugin, and only the one part was compromised after. The files I found that restored my site long enough to get my hosting provider to fix the rest were new files created that day and that time in my WordPress plugin files in a folder for the Maintenance Mode plugin in a folder that had not finished downloading and my WordPress said there was an error with the plugin. Something doesn’t add up. Within the past month more than just me have reported the plugin messing up their sites and blogs. More than just me have reported the plugin and even Esmi said it was “unlikely” not impossible. In the past month a fantastic plugin has been likely responsible for messing up several sites…it may be worth paying some attention to instead of arguing with already upset users.

I posted on the forum of the plugin that was ALSO hijacked and gave the problem to me…

I was rudely told not to make such accusations and they linked to THIS support thread to say I have taken back my accusation and it was my server’s fault. Then they closed my post. Um…my server FIXED it. It was still the Maintenance Mode plugin that gave it to me. Not intentionally, but I believe it is infected too. You’d think you could find better help online eh dontbegauche?

I’d look into changing hosting. There are times when my hosting provider is the only one who can save me.

I contacted my host, who removed the rest I didn’t find. You’re right. All the articles say check .htaccess, but they inject a fake one in EVERY folder. This hack seems to be common but not often talked about, probably because many people wouldn’t notice and would assume their site is just messed up.

I hope plugin owners start checking their own stuff more often because others not noticing is how it’s spreading. Let me know if your hosting provider gives you any helpful hints 🙂