I have an odd issue here. I’m hosting a site that’s running the latest version of WordPress, and very few plugins, among them an older copy of WooCommerce (2.1.12, Jan 2014). The theme is MyCuisine from Elegant Themes. A couple days ago porn links started showing up in various places around the site, mostly WooCommerce pages, but also the site’s wp-login.php file (there was no malicious code in this file at all, but the links were appearing just after the login fields).<\/p>\n
When I disable WooCommerce, all the links go away. When I reenable the plugin, they don’t come back. Has anyone seen this behavior before and perhaps know which vulnerability it may be tied to? We’re working to update the template files so we can upgrade to the latest version of WooCommerce, but I’ve been looking around for info on WooCommerce security issues and haven’t found anything like this.<\/p>\n
Thanks.<\/p>\n
https:\/\/wordpress.org\/plugins\/woocommerce\/<\/p>\n","protected":false},"template":"","class_list":["post-5542793","topic","type-topic","status-closed","hentry","topic-tag-sql-injection"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/5542793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/5542793\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=5542793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}