3 {{ upvoteCount | shortNum }}
3 {{ upvoteCount | shortNum }}

Possible WP Plugins That Are Security Risks?

by AceOfShirts
2 replies
I was looking at the AWStats for one of my sites. I noticed a couple of 404 errors so I looked to see what they were. A couple of them were readme files for WP Plugins I don't have installed, and have never used. Here are the errors:

/wp-content/plugins/connections/readme.txt

/wp-content/plugins/backwpup/readme.txt

They were also searches for

crossdomain.xml (which I have never used or heard of)


Who would be looking for or linking to a plugin readme file? My first guess is hackers trying to see if I have a vulnerable plugin installed.

Any other ideas?
#plugins #risks #security
  • Profile picture of the author lotsofsnow
    That sounds about right.

    Somebody tries to exploit a vulnerability that he or she found in a piece of code and then they try to find sites that have these plugins installed.

    HP
    Signature

    Call Center Fuel - High Volume Data
    Delivering the highest quality leads in virtually all consumer verticals.

    {{ DiscussionBoard.errors[4421591].message }}
  • Profile picture of the author Istvan Horvath
    Yep, both those plugins had security issues.

    I guess a script was checking the readme file because people usually upload everything - including the readme files - to their sever. If the file is present... the blog can be hacked, since they knew exactly what the vulnerabilities were. They just had to check if the plugin is installed
    Signature

    {{ DiscussionBoard.errors[4421620].message }}

Trending Topics