Conversation
supportHey fellow WordPressers I’m pretty new to Web Administrating and got caught up in the admin permissions breach introduced with the Burst Statistics 3.4 update. Although I updated to the latest Burst 3.4.3, several unauthorised administration accounts exploiting the weakness remained. The 10 accounts entitled: burst_ random numbers were assigned protonmail.com email addresses. They’re deleted now. I also revoked Administration permissions Burst MainWP from my admin account. Thus far, Broken Link Check identified no broken links, which is a good sign, I think. So I believe I removed them before any damage was done. But is there anywhere else I ought to look? Anyone else cleaning up.
@rlddg I’m sorry to hear you were affected. It sounds like you’re on top of things. It’s usually best to reinstall WordPress and your plugins and theme, so you can be sure it’s all fresh code. If you install WordFence you can run a scan to check for any leftover issues. This reply was modified 5 hours, 25 minutes ago by Rogier Lankhorst .
Thanks, Rogier Reinstalling the theme maybe problematic as I’ve greatly modified the template. As I said, I am quite new to this. Appreciate the fast response. Rachael
In that case I’d run a WordFence scan, to catch anything in the theme. Alternatively you can drop the zip in an AI tool and ask it to check for issues.
Great, thanks. Working with Gemini at the moment on activity after the breach. It’s looking benign. Will run the WordFence scan afterwards. *edited to reflect current findings This reply was modified 4 hours, 9 minutes ago by rlddg .
@rlddg I’m sorry to hear you were affected. It sounds like you’re on top of things. It’s usually best to reinstall WordPress and your plugins and theme, so you can be sure it’s all fresh code. If you install WordFence you can run a scan to check for any leftover issues. This reply was modified 5 hours, 25 minutes ago by Rogier Lankhorst .
Thanks, Rogier Reinstalling the theme maybe problematic as I’ve greatly modified the template. As I said, I am quite new to this. Appreciate the fast response. Rachael
In that case I’d run a WordFence scan, to catch anything in the theme. Alternatively you can drop the zip in an AI tool and ask it to check for issues.
Great, thanks. Working with Gemini at the moment on activity after the breach. It’s looking benign. Will run the WordFence scan afterwards. *edited to reflect current findings This reply was modified 4 hours, 9 minutes ago by rlddg .