The Wordfence team reports at least 130 million attacks were detected between May 29 to May 31, 2020. The attacks were intended to harvest a website’s database credentials by downloading the configuration files.

Most of the attacks were targeted at the vulnerabilities in outdated plugins and/or themes that allow files to be downloaded or exported.

To confirm whether your website has been compromised, check your server logs and look for any entries containing wp-config.php in the query string that returned a 200 response code.

Here are the top 10 attacking IP addresses in this campaign:

200.25.60.53
51.255.79.47
194.60.254.42
31.131.251.113
194.58.123.231
107.170.19.251
188.165.195.184
151.80.22.75
192.254.68.134
93.190.140.8

Sites running the Wordfence plugin should be safe from these attacks. If you believe your website has been compromised, change your database password, and authentication unique keys and salts immediately.

For more information please check the official public release.

Beyond that, it is strongly recommended to update your themes and plugins to their latest versions and ensure that your host is using the latest stable version of PHP.

If you have questions, don’t hesitate to contact our support team.

People that read this article also liked

Critical Vulnerabilities Found on PageLayer Page Builder Plugin WordPress Websites Security Breach – Outbreak of Malicious File Attacks Outdated WPBakery Plugin Critical Security Risk to Millions of Sites WordPress 5.7 “Esperanza” + WooCommerce 5.1 Released