countdown plugin closed on the plugin directory, am I hacked?

troygray88

The countdown timer we use for the sale banners said this morning that the plugin was closed on wordpress.org.

And it had updated itself overnight without me touching anything.

I read that closing as the developer pulling it, and then it still pushed an update. That's the part I don't like.

The site looks normal from the outside. Nothing in the dashboard says anything either way:

Does a closed plugin that updates itself mean somebody else has taken it over?

JavierCastro

A whole family of plugins was sold to someone who planted a backdoor. Then a cleanup update came through the plugin site. That cleanup does not undo what ran before it. Check your users list for an admin account you did not make. Change the admin and hosting passwords today.

troygray88

Checked the users list like you said, and there it is.

An administrator account I never made, created last week.

So it wasn't just the plugin updating itself, somebody has been in here.

Mattia

Log into wp-admin and delete that account. Then change every admin password and your hosting password too, and ask your webhost for a malware scan.

Mine did it for free, within a day.

troygray88

Removed that account and plugin: after a scan, my webhost said they found 1 file modified and replaced it with a fresh copy.

I'm using a much simpler countdown from now on.