There has been a major security breach on my client’s site that I was just made aware of. I am currently in touch with my support team at Inmotion. My client has a reseller’s account with me. Right now, I am merely trying to investigate where the vulnerability might have accord. From the time stamp on newly generated content. This happened yesterday on June 10th.
The breech was catastrophic in scope. Content site wide was wiped clean. Nothing is left.
There are signatures that have me concerned it might have been compromised through the Pro heme but in no way am I making any accusations that it this is related to your theme. At this point I’m just getting started with tracing. In all of my time developing, I’ve never had a breech this damaging. It could be anything from relaxed admin security, relaxed plugin updates, or something left unintended inside of .htaccess; I really don’t know.
Here is what I know so far: Either a script or a user gained access as the top level Admin. I am inclined to believe it was a script because everything was removed. It wiped out all of the content I built through Pro.
At first it appeared as though it wiped out the entire WordPress installation and replaced it with a fresh install and built one page that added a couple of blocks of content advertising generic ads unrelated to anything relevant. However, themes remained intact as well as all plugins. All plugins were deactivated though. The Pro theme was activated. The red flag that has me concerned about a vulnerability breeched through your theme is that Pro’s activation key was removed and it is no longer activated and linked with my X-Theme account.
Everything was removed including any of the custom templates built through the builder. (e.g. headers, footers, landing pages and custom content.)
Other content was also removed like the archived states built with Duplicator, too. As recently as the end of May, I duplicated the site in case something went wrong after I performed regular maintenance updates to the theme, WordPress and plugins. Any and all content is gone, even from the other 3rd party plugins packaged with Pro.
Deleted content effecting the 3rd plugins or content associated with WordPress include:
- WP Admin Area
(All roles deleted and replaced with a randomly generated email string and a generic Admin ) - All WP Media
- All custom content inside LayerSlider WP
- All custom content inside Essential Grids
- All custom content inside WooCommerce
- WPForms (not associated with X-Theme)
- GigPress (not associated with X-Theme)
It does not appear Cpanel was breached, nor the root of the server. WP snapshots also seems to still have a May Archive associated with the backup I made.
I would like to know if there has been any other users who have reported similar incidents with this level of destructive damage? Is there any help I could get with other areas, files or folders I should inspect in my tracing investigation searching for clues or signatures of where the breech may have first occurred or out of place code generated either within the theme folder or outside of the theme but within the WordPress build or other plugins? I am trying to find where the broken chain is. I don’t want to go through the restoration process if I’m still leaving the site open to another attack.
Thanks in advance
LB