Doc’s WordPress News Drop is a weekly report on the most pressing WordPress news. When the news drops, I will pick it up and deliver it right to you.
This week we talk about hijacked WordPress.com accounts, WordPress’s 15th birthday, and more WordCamp Europe news.
WordPress Milestones
WordPress Jetpack infection (Wordfence.com)
WordCamp Europe 2018
Love WordPress News but hate reading? My name is Doc and this is Doc Pop’s News Drop.
This week we’ll talk about WordPress’s 15th birthday and WordCamp Europe, but first:
Did you know that even if you are self hosting your own WordPress website, it can still get hacked if your WordPress.com account gets compromised? That’s a lesson I learned the hardway last week when hackers compromised my WordPress.com credentials then installed malicious code and plugins onto my self hosted site via the Jetpack plugin. I always hear people talk about Jetpack being bloated, but I had no idea it could be used to install malware on WordPress.com. I’m usually pretty good at using complex passwords and changing them all on a yearly basis thanks to my password manager tool, but I have to admit my WordPress.com password was from back when security wasn’t quite as big a concern for me. Since I never use WordPress.com, I hadn’t realized it was so out date. Of course I never realized that it had so much access to my personal site too.
If you are running a WordPress site with Jetpack installed, you should probably check and see if your site was compromised too. The easiest way to check is to go to your plugins page and see if there are any unrecognized plugins there. Specifically you should look for one called “pluginsamonsters”. Whether or not that plugin is activated, if you see it in your plugins then your site has been compromised.
Simply removing these plugins will not solve the problem though, so here’s what I would recommend. First off, go to WordPress.com and change your password to something secure and unique, then enable two factor authentification on WordPress.com and on your site, you can install a plugin like Authy for this. Then you’ll need to reach out to your host to see if they can help scan and remove the malicious code from your site. I use WPEngine for my hosting and their support team helped remove the malware for me. If you are running on managed hosting, there’s a good chance this scan has already happened since the “pluginsamonster” hack was reported by WordFence last week. If you aren’t using managed hosting and can’t get support, then try installing a security plugin like WordFence or Sucuri to scan your site and remove the malicious php.
So let that be a reminder to always keep your passwords up to date, use two factor on everything (even on WordPress.com) and maybe reconsider using Jetpack. For more info on this recent hack, check out the great article on WordFence.com which we’ll link in the description.
WordPress turned 15 this weekend? Did you celebrate it? WordPress meetups across the globe celebrated, including the East Bay WordPress group here in the Bay Area. If you missed out on the fun, you can search the hashtag #wp15 to see what happened, and you should also check out our post on TorqueMag.io about the big WordPress milestones in the past 15 years. We’ve also created a spotify playlist featuring all of the jazz musicians whose names have graced various WordPress versions throughout the years.
Speaking of WP15, Jenny Beaumont has another great update about WordCamp Europe, extra WP events in Belgrade, and WP15 celebrations.
Thanks Jenny!
That’s it for this week’s news drop, be sure to check the links in the description for more info on this week’s topics and stay tuned next week for more WordPress News.
Doc Pop
Doctor Popular is an artist and musician living in San Francisco. As a full disclaimer, he is neither a doctor nor popular.
The post Doc Pop’s News Drop: Hijacked Jetpack Plugins via WordPress.com appeared first on Torque.
