Wordpress platform site hacked

[Orange Julia]

I am trying to help another non profit unfuck their site, which has been compromised by some malicious content, but I can't login via wordpress. the site is hosted on dreamhost which seems to have no support for this thing. I can sort of see that it is at least one of the plugins that might be causing the problem, and perhaps an unused theme but I don't know how to get in there to clean everything up. I can get to the dreamhost control panel but when i click on dreampress, I just get this:


Warning: include_once(/home/wp_5hwj9z/babywearinginternational.org/wp-content/plugins/woocommerce/includes/abstracts/abstract-wc-shipping-method.php): failed to open stream: Permission denied in /home/wp_5hwj9z/babywearinginternational.org/wp-content/plugins/woocommerce/woocommerce.php on line 274

Warning: include_once(): Failed opening 'includes/abstracts/abstract-wc-shipping-method.php' for inclusion (include_path='.:/usr/local/lib/php:/usr/local/php5/lib/pear') in /home/wp_5hwj9z/babywearinginternational.org/wp-content/plugins/woocommerce/woocommerce.php on line 274

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at /home/wp_5hwj9z/babywearinginternational.org/wp-content/plugins/woocommerce/woocommerce.php:274) in /home/wp_5hwj9z/babywearinginternational.org/wp-content/themes/fruitful/inc/func/comment-inline-error.php on line 9

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at /home/wp_5hwj9z/babywearinginternational.org/wp-content/plugins/woocommerce/woocommerce.php:274) in /home/wp_5hwj9z/babywearinginternational.org/wp-content/themes/fruitful/inc/func/comment-inline-error.php on line 9

Warning: Cannot modify header information - headers already sent by (output started at /home/wp_5hwj9z/babywearinginternational.org/wp-content/plugins/woocommerce/woocommerce.php:274) in /home/wp_5hwj9z/babywearinginternational.org/wp-includes/pluggable.php on line 1179

 

[Blacken]

Dreamhost doesn't support Wordpress security because they can't; there is no really good security option there. "Nuke it from orbit" is the only safe way to deal with a compromised Wordpress site. You aren't going to be able to just fix this and keep going unless you are extraordinarily lucky.

So back up the database. Have someone audit the database for injected code to re-compromise a new install. Remove the entire site (copy it to a backup directory for reference but do not execute it). Reinstall Wordpress. Install plugins. Stay patched.

 

[Orange Julia]

Thank you. It seems they are never updating WordPress or any of the millions of plug-ins. I'll pass along your advice.

 

[canderson]

For future purposes, I highly recommend UpDraft Backup for WP. You can DL the entire site database, themes, plugins, etc. so nuking and rebuilding is painfree.

Just make sure to save the download locally somewhere (or to a cloud service they can connect go).

 

[Blacken]

Yeah, that's a good call. UpDraft is really good.

Make sure to version the downloads; you may get owned and not realize it for a while.

 

[Orange Julia]

Thanks guys.