Comments on: WordPress, remv.php and You

By: Juvy Barbosa

Juvy Barbosa — Mon, 19 Jan 2009 02:50:10 +0000

That’s a great article, Jason and ought be required reading for anyone running a WordPress blog. It gave remote browser access to my entire directory tree, modify any file, seemed like it might be able to change modification times.

Regards
Juvy

By: Laughlin

Laughlin — Thu, 18 Dec 2008 14:21:00 +0000

Got a message from google that my site was spamming. Found remv.php more or less by accident. Found out what it did by commenting out the line that checks to see if you are from the allowed list of IP addresses (near the beginning).
It gave remote browser access to my entire directory tree, modify any file, seemed like it might be able to change modification times.
So I look through every file (and there are a lot). Peppered through the directories are php scripts disguised as other things (eg picture.php.jpgg, right under picture.jpg).
Make sure you check your files!
Did the reinstall thing.

By: Anders Saugstrup

Anders Saugstrup — Sat, 13 Dec 2008 08:47:16 +0000

Good find!

I will warn the Danish audience.

Any knowledge on what versions of WordPress are safe from this hack?

By: rlparker

rlparker — Thu, 11 Dec 2008 11:40:19 +0000

That’s a great article, Jason and ought be required reading for anyone running a WordPress blog. I’ve linked it from a post on the DreamHost forums, in hopes others can benefit from it. Rock On!