Plugin Self Destructs

  • Resolved zorba256

    (@zorba256)


    5 years, 5 months ago

    I’ve been a very satisfied customer of both the free and paid for versions of BBQ for a couple of years now.
    After updating a series of plug-ins yesterday including the free version of BBQ firewall, I was surprised to see the message “Plugin File Does not Exist” and warnings at the top of my Dashboard. Upon investigation I found that within seconds of the latest version of the plug-in being added, the key source file (block-bad-queries.php) disappears. This is true whether the installation is done via the WP Plugins web page or via downloading the zip file and adding the contents of the archive manually via FTP. I’ve tried both the latest update and the November versions with the same result.
    The message about the file being missing is generated when I attempt to activate the plugin and the net effect is that the plugin disappears from my list of plug-ins on the WP Plugin back-end screen. I’ve found that other plug-ins may be updated and new ones added without any issues.
    I have two “copies” of this site with slight variations on the same server (used as “development” and “test”) and both exhibit exactly the same symptoms.
    Is this a BBQ issue or do I have some infection or is there some other factor at play on the site that is triggering this action? When the problem was first observed I did not have any security plug-ins installed or active and just relied upon basic auth login protection for the sites. Since then I’ve installed and run both Sucuri and WordFence free versions and scanned more than once with no malicious files found on either site.
    All suggestions gratefully received.

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Author Jeff Starr

    (@specialk)

    5 years, 5 months ago

    Bizarre. Never heard of anything like this in 10 years. Not sure if there is anything I can offer here. Normally the plugin does not “Self Destruct”, as can be verified on default WordPress installation.

    In any case, I can recommend troubleshooting your setup, examining your error logs, and yes definitely should be investigating possible security breach. It sounds like there may be a rogue script somewhere on the server, or something.

    I hope this helps. Feel free to post again with any further questions, feedback, etc. Glad to help however possible.

    Plugin Author Jeff Starr

    (@specialk)

    5 years, 5 months ago

    Do you still need help with this, @zorba256?

    Thread Starter zorba256

    (@zorba256)

    5 years, 5 months ago

    Thanks for your offer of further help. I’m getting nowhere in tracking down the source of the problem. I’ve tried turning on debug but there are no entries in the error logs. Further extensive scans with WP security products reveal nothing either.
    I’m now working on the assumption that this problem is unrelated to BBQ itself and results from some external security breach: others do have access to WP accounts on this environment. Changing the file name of the affected plug-in file does not solve the issue either, so something must be looking for signatures within the file itself.
    I’ve been the victim of major attacks on unrelated public WP sites before, where files types as various as jpg and PDF have been infected with hidden code, while their date stamps remain unchanged. So I know it’s going to be more or less impossible to find the culprit without a professional clean up that I cannot afford here.
    Happily the environment is only used for development and test, and there’s nothing much going on there now. Ultimately it can be abandoned and rebuilt from scratch if it’s still required long term.
    I hope that this enquiry will not put off others from employing your BBQ Tools which are still proving invaluable in protecting my live WordPress environments from attack on a daily basis.

    Plugin Author Jeff Starr

    (@specialk)

    5 years, 5 months ago

    Alright it sounds like you’re taking care of things and that the issue is not with BBQ plugin. I’ll go ahead and mark this thread as resolved, so feel free to post again with any further questions, feedback, etc. Glad to help anytime.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Plugin Self Destructs’ is closed to new replies.