{"id":10664945,"date":"2018-09-06T21:34:37","date_gmt":"2018-09-06T21:34:37","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/new-hack-with-file-temp-crawl-php\/"},"modified":"2018-09-06T21:39:50","modified_gmt":"2018-09-06T21:39:50","slug":"new-hack-with-file-temp-crawl-php","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/new-hack-with-file-temp-crawl-php\/","title":{"rendered":"New hack with file “temp-crawl.php”"},"content":{"rendered":"

Notification of possibly new hack\/malware:<\/p>\n

Today our site “rebooted” to showing the install page.<\/p>\n

In the wordpress root directory a new file appeared, “temp-crawl.php” with code:<\/p>\n

[ Please don’t post hacking code. Thanks.]<\/strong><\/em><\/p>\n

This appears to take the contents of supplied URL parameter ‘q’, write them to a new file “tempcrawl”, execute that file, then delete the file.<\/p>\n

I deleted temp-crawl.php but don’t know where the vulnerability was.<\/p>\n

Currently there are zero google search results for “temp-crawl.php” so this might be something new(?)<\/p>\n","protected":false},"template":"","class_list":["post-10664945","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10664945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10664945\/revisions"}],"predecessor-version":[{"id":10664965,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/10664945\/revisions\/10664965"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=10664945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}