Wordpress Broken Link Checker Malware Alert!

Yesterday I published a post about WordPress security where I outlined some of the steps I take to keep a WordPress site safe from those evil so-and-so's who would love nothing more than to get control of my site to enlarge their sphere of evilness.

As I said at the beginning of that post, one of the greatest things about WordPress is that when a problem is identified it gets fixed pretty quickly.

That's great, but what about the plugins?

There are literally thousands of excellent plugins available for WordPress, many of them are free, which make it possible to do just about anything you want with your site. These are all built and maintained by individual developers.

Of course when you choose to install a plugin you need to have faith that the developer knows what they are doing, and that they will continue to maintain their code as time goes on.

One plugin I like to use is the Broken Link Checker, a nifty bit of software that monitors the site for, you guessed it, broken links. As a site grows over time things change online. Sometimes sites change, sometimes they are removed. Broken Link Checker finds them right away and I can correct the problem.

Keeping WordPress Plugins Secure

This morning I logged on to find this in my email:

Wordfence found the following new issues on "i7 Marketing".

Alert generated at Tuesday 9th of July 2013 at 08:14:58 AM
Critical Problems:

* File contains suspected malware URL: [...path removed]/wp-content/plugins/broken-link-checker/languages/broken-link-checker-ar_AR.mo
* File contains suspected malware URL: [...path removed]/wp-content/plugins/broken-link-checker/languages/broken-link-checker-ar_AR.po
* File contains suspected malware URL: [...path removed]/wp-content/plugins/broken-link-checker/readme.txt

In my column yesterday I recommended the Wordfence Security plugin to monitor your WordPress site. Yesterday I also updated the Broken Link Checker plugin, Wordfence found a problem with the new files, and notified me.

Fixing the Malware Problem

The first thing to go through my mind was "Oh no! My beloved Broken Link Checker has a virus!" Since I just updated the plugin I was I figured that our site hadn't been hacked, the problem is most likely with the new plugin files. So I went to my old friend Google to see if anyone else was having this problem.

It didn't take me long to find other people talking about this problem, most notably on the WordPress support page for the plugin:

http://WordPress.org/support/topic/known-malware-site-in-translation-files?replies=8

A quick read of that thread points out a couple of important things:

• There is no virus in the plugin, but some of the translation files (Arabic translation) files link to a page that has been flagged for malware.
• This was detected very quickly.
• A short term solution exists (remove the offending files).
• The developer will fix it in the next release - hopefully very quickly.

So I fired up Filezilla, the excellent and free ftp client, connected to my server and deleted the offending files. Once that was done I went into my Wordfence admin on the WordPress Dashboard, ran a scan and verified that the problem was solved.

(If you try this yourself be careful to remove only the offending files.)

WordPress Security Requires Diligence

Any type of security requires constant monitoring, it's a game of cat and mouse. Just look at all that hacking going on between the US and China! With a few tools and some common sense you can hopefully catch those things right away.

7-10-13 UPDATE - The developer released an update, version 1.8.2, that corrects the issue. Get it here.