[Ethan]

Saw this on a client site:

/wp-content/updraft/emptydir/admin.php full of malware code, what is this folder created by Updraft doing anyways? and why so easy to add malware inside that folder.

[Christina]

Backup is placed in FTP

why is this folder installed by Updraft? they don’t say.

[Scott]

Damn. Is Updraft getting exploited?

[Jose]

Not the first time. Been happening for a few years at least:

Recovering from a WordPress Plugin Exploit

[Albert]

We’ll also extract and copy the public_html/index.php file from the old backup to the server, because the existing one looks weird (it contains a PHP @include directive to include the file /home/username/public_html/wp-content/updraft/emptydir/.684f3ddd.ico using some octal escapes (\nnn) to unnecessarily (they were standard ASCII characters) specify some of the characters in the file name.

[Michelle]

Some shady results on Google serps also infected

https://www.google.com/search?q=%22updraft%2Femptydir%22

[Christian]

weird.

[Kevin]

is this Updraft’s fault? or some permissions thing that is allowing malware to put files in there as a convenient location sort of like the /wp-content/upgrade/ folder or something???

[Author]

Posts