Some of the websites I have built use a plugin called Fast Secure Contact Form. It was a very popular form handler highly regarded by users written by Mike Challis. The plugin was sold to a third party in June of this year and the new owner attempted to manipulate the code in the plugin to set up adverts.
Please check ASAP whether the version that is currently in use on your website is version 4.0.56. You can do that by logging in, and going to the Plugins page and look down the list. You will see an entry similar to the one below which includes the version number.
If you have version 4.0.56 you are OK! Don’t panic.
If your site is at an earlier version contact me immediately and I will sort out updating it.
(update: 6:00am 27/9/17 Nobody has reported a problem so far, all sites have upgraded automatically. That was to be expected. If you cannot find Fast Secure Contact form another method is used for forms on your website. Probably Form Manager. You are not affected by this notice.)
Why is this important?
The plugin was withdrawn by WordPress from the plugin repository over the weekend (24/9/17). The plugin was sold by the author to a rather unscrupulous person that attempted to manipulate the code to add adverts to a payday loan company through this plugin and several other plugins that they have acquired. This has been detected by the WordPress community and the plugins have all been withdrawn.
The first thing to note is the changes to the code did not work in this particular case. However the code was present in versions 4.0.52, 4.0.53, 4.0.54 and 4.0.55. If you have any of these versions present in your website please contact me immediately. All sites have a mechanism for updating plugins automatically, so all of them should have updated to version 4.0.56 today or overnight.
The plugin no longer exists within the WordPress family, although there is a hidden version that is certified clean by the original author, which is why it is important make sure we are using the last version of the plugin.
Have I or my clients been affected?
No, the author Mike Challis writes: “The spam code in this plugin was never activated, it would not have corrupted your posts or changed anything in the WordPress database.”
Diligent WordPress Community
I monitor several news feeds on security, and there have been several reported cases of injected spam into plugins over the past few months. We were not using any of them. You can read about them here: Co-ordinated Plugin Spam.
There are several groups active in the field of security that also have secure plugins (one of which we use), that are constantly monitoring websites and quickly identify any odd behaviour. That was how this one was discovered.
Why would someone do this?
One can only speculate that it is a way of making money through referrals to another website. If an advert was to pop up, and someone subsequently followed it then every referral might receive a payment.
Long Term Plan for Wingrove-Media sites
I will start looking for an alternative contact form and replace the forms on affected sites over the next few months. Right now there is no reason to be alarmed. If you have any concerns please do contact me to discuss them.
Further reading…..
Not essential, but fascinating nonetheless!
Pour yourself a glass of wine and read this from the Wordfence research team. We use Wordfence on all of the sites. The team have come across a multi threaded set of evidence leading to one person. Man behind the spam