Plugin was compromised

Hi @lukameci,

Thank you for getting in touch. My apologies for the trouble experienced.

Yes, there was a known exploit that allowed this endpoint to be exploited, and it was reported to us in December. We acted quickly to get patches out to secure the endpoints. After this we released updates which attempt to cleanup any known data, based on what we knew about the redirects being stored.

At this point in time, I can confirm that this vector is no longer accessible to new attacks, but it is possible that your marker data has not been cleaned up properly. If you are open to sharing your marker data with us via our website, we can help you in getting rid of any of the redirects, as well as expanding our cleanup system to remove this across sites.

We are aware of a fatal error which is being thrown on that endpoint as it seems there are still scripts attempting to perform the same actions. That fatal error will be solved in our update which we expect to be released tomorrow.

Again, we’d appreciate you reaching out to us directly so that we can work with you more closely in solving the issue with your existing markers.

Hi @johnwpc,

Thank you for sending over the details on our website. We’ll be in touch as soon as possible to assist.

For reference, this thread is also related: https://ww.wp.xz.cn/support/topic/fatal-php-error-39/ – The root cause of errors being reported has been resolved, meaning the invalid requests (likely from a 3rd part) have been fixed.

We aren’t able to block these kinds of requests as the API endpoint is public, and is used to fetch marker data, but the sites running updated versions will no longer cause any fatal errors.

With that said, we’ll discuss this further with you via email!

Hi @rservaas,

Thank you for reaching out, we do appreciate your time. The issue within the code was solved some time ago, this has been confirmed in various tests since then.

However, we also released a few updates which attempt to clean/remove any already exploited data. Unfortunately, it’s not possible for us to anticipate every URL/pattern that might have been used, which means some may not have been fully cleared.

I noticed you mentioned that you have since resolved this, but for anyone else who may have a similar situation, we do encourage reaching out to us on our website, so that we can take a closer look.

We do appreciate everyone’s time and understanding in this regard.

Hi @samuelldrew,

Thank you for letting us know, we do appreciate your time and insight. We have recently become aware of another script pattern which is affecting some users.

We’ve released an update which will automatically clean up marker fields which were compromised by previous weaknesses in the REST API endpoints.