Opened 19 months ago

Last modified 19 months ago

#12497 assigned Bug/Something is broken

CVHPower website not working

Reported by: https://id.mayfirst.org/aaronpower Owned by: https://id.mayfirst.org/jaimev
Priority: Urgent Component: Tech
Keywords: Cc:
Sensitive: no

Description

CVHpower.org website is not working and has not been operational for weeks. I sent a ticket a few weeks ago and I have not heard back from you and the website is still down.

Change History (4)

comment:1 Changed 19 months ago by https://id.mayfirst.org/aaronpower

  • Owner set to https://id.mayfirst.org/aaronpower
  • Status changed from new to assigned

comment:2 Changed 19 months ago by https://id.mayfirst.org/jaimev

  • Owner changed from https://id.mayfirst.org/aaronpower to https://id.mayfirst.org/jaimev

Hi, aaron,

I did see the ticket you opened https://support.mayfirst.org/ticket/12454 but I think maybe you didn't see my response.

I responded to you there that we should follow up on ticket https://support.mayfirst.org/ticket/12413 that I had already opened about the problems with your site. I copied you on that ticket and I also attempted to contact your organization with the contact info we have for you. Your site was compromised and was being used to send spam through the host server.

comment:3 Changed 19 months ago by https://id.mayfirst.org/aaronpower

Got it! I did not see your response, but thank you for sending it again. Is the contact person you have on file Michelle Perez? If not, we've had some staff turnover since setting it up and need to change it to Aaron Jones (Aaron@…) and Michelle Perez (Michelle@…).

What are the next steps to addressing this issue?

-Aaron J.

comment:4 Changed 19 months ago by https://id.mayfirst.org/jaimev

Thanks, I've just updated your listed contacts in the control panel. I've also added you to the member access list for the Community Voices Heard Power membership control panel. You can now review and modify the contact list directly through https://members.mayfirst.org/cp/index.php?area=member&service_id=16&member_id=937

I have used wp-cli to disable the wpgform plugin on your site. Unfortunately this is probably not enough to protect your site if the compromise has already modified core files your theme or your database. I highly recommend doing the following:

  • re-enable your site through the web configuration control panel for CVHpower.org

https://members.mayfirst.org/cp/index.php?area=hosting_order&hosting_order_id=1000932&service_id=7

  • disable all plugins
  • ssh/sftp to your host dorothy.mayfirst.org as user cvhpowerweb
  • backup up your existing site.
  • delete all files from your web folder
  • perform a complete install of wordpress to your web folder
  • reinstall updated plugins from source
  • carefully review wp-content folder for modified files or executable code in your uploads folder before restoring this folder to the new install
  • scan database for any signs of compromise before restoring mysql access credentials in wp-config.php

Please login to add comments to this ticket.

Note: See TracTickets for help on using tickets.