{"id":10570579,"date":"2018-08-08T10:08:58","date_gmt":"2018-08-08T10:08:58","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/danger-security-issue\/"},"modified":"2018-08-08T10:49:04","modified_gmt":"2018-08-08T10:49:04","slug":"danger-security-issue","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/danger-security-issue\/","title":{"rendered":"!DANGER! Security issue"},"content":{"rendered":"<p>I got now 2 websites with PHP malware,<br \/>\nplugins that are on both are: Ultimate member, ACF, WPML and WP Migrate DB,<br \/>\nhowever the latter 3 are on other sites that work fine.<\/p>\n<p>Also same behaviour is that<\/p>\n<p><code>\/wp-content\/uploads\/ultimatemember\/temp<\/code><\/p>\n<p>this folder contains suspicious folders and PHP files in them, attacks are often more site-spread, so only suspect remains this plugin.<\/p>\n<p>Can you please look into this issue?<br \/>\nDoesn&#8217;t your file upload have a security hole somewhere?<\/p>\n<p>\/\/USING LATEST ULTIMATE MEMBER, LATEST WP\/\/<\/p>\n<p>Also your check_file_upload() method checks extension, not a real file type! Which is an issue itself&#8230; <\/p>\n","protected":false},"template":"","class_list":["post-10570579","topic","type-topic","status-publish","hentry","topic-tag-security-hole"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10570579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10570579\/revisions"}],"predecessor-version":[{"id":10570753,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10570579\/revisions\/10570753"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=10570579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}