These SQL injections have been coming in daily to this site which has still seemingly managed to avoid infection simply because of the changed database prefix. This one uses the “author not in” query bug inside some crazy nested query to place the payload in the database.

This is all related to the WP2Shell bug which was reported over a month ago. The site had auto updates disabled and still managed to avoid getting infected because of some seemingly silly security practices like changing table names and database prefixes. As far as I can tell all of these failed. I was alerted to the issue because the site got locked in a loop of timeouts, perhaps related to these malformed queries. Unfortunately I’m going to have to do some kind of a forensic workup even though there were no clear indicators of compromise because requests to the batch endpoint resulted in many 207 codes which means they may have succeeded.

But when I saw the giant block of 0s and 1s and hex codes in the logs, my heart dropped into my stomach. Stay safe out there people and leave auto updates on. It’s worth the chance of breaking your site every once in a while.