Resolving WooCommerce Plugin and Theme Issues

Reading Time: 2 minutes

What is WooCommerce?

WooCommerce is a plugin with regular updates releases, which means it will add new and existing features, along with resolving any bugs or known security vulnerabilities. WooCommerce is actively installed on over 4 million WordPress sites and is used to drive E-commerce on a pretty high number of those sites.

 

Testing for Plugin and Theme Issues

Continue reading “Resolving WooCommerce Plugin and Theme Issues”

Rollback a Plugin or Theme Using WP-CLI

Reading Time: 2 minutes

WP-CLI makes it very easy to rollback plugins and themes as well as update plugins and themes on sites all from command line. This is useful if you see your site is broken by a newer version of the theme or plugin. In this article, we’ll be running through some valuable commands for rolling back your site.

If you need to rollback a plugin on a site to a previous version, you can find the previous version number from the development tab of the plugins listed on WordPress.org. To find the slug of the plugin, you will need to go to the WordPress.org plugins. In the case of Contact Form 7, the plugin slug is contact-form-7.

Note:
You can also find the plugin or theme slug by going to your WordPress files and typing in:
wp plugin list

wp theme list

Pre-flight

Rollback a Plugin to a Previous Version

If you need to test that the command is correct, you can always use the flag –dry-run at the end of the command:

wp plugin update contact-form-7 --version=5.0.5 --dry-run

In the following example, to rollback Contact Form 7, you can use this command:

wp plugin update contact-form-7 --version=5.0.5

 

Activate A Particular Version of a Plugin

If you need to install and activate a previous version of a plugin, run:

wp plugin install contact-form-7 --version=5.0.5 --activate --force

 

Update All Plugins

If the plugins you updated have been fixed and you now need to update all plugins, the example command is:

wp plugin update --all

Excluding A Plugin

If you want to update all plugins, but need to exclude a specific plugin (in this case WooCommerce), run command:

wp plugin update --all --exclude=woocommerce

 

Rollback a Theme to a Previous Version

If you did need to rollback a parent theme to a previous version, you could use this command example which would rollback the Storefront theme to version 2.4.0:

wp theme update storefront --version=2.4.0

 

Update Theme to Current Version Release

If you know wanted to update the Storefront theme on a site to the most current version, you could use this command example;

wp theme update storefront

 

Using a mix of these WP-CLI commands will enable you to easily rollback a plugin on your site, rollback a theme, or update all plugins. It will also update all plugins, but exclude a specific plugin from being updated.  Our Managed WordPress product comes with WP-CLI installed along with easy, automatic updates.  Check out how our Managed WordPress platform can streamline your work today!

WordPress Exploit – AMP Plugin

Reading Time: 2 minutes

AMP for WP -Accelerated Mobile Pages allows your site to be faster for mobile visitors. Along with last week’s report, the AMP plugin has also been added to the list exploited. The AMP for WP plugin was reported on October 20, 2018, by its developers. Luckily, the newest version, 0.9.97.20, of this plugin has patched for their known security flaws. This exploit has the means of putting 100,000+ users at potential risk, so its best to check if you are utilizing this plugin. In this tutorial, we will be checking if you use this plugin. Along with updating, we will also show you how to check if your site for compromises.

In the vein of the WP GDPR plugin exploit, the AMP hack allows code vulnerability to make site-wide changes. Bots scan for sites using the AMP plugin and use an XSS security bug to create a new user that has admin-like privileges. The vulnerable versions’ (below 0.9.97.20) code didn’t cross check to see if registered users had the permissions to perform some actions. With administrative like privileges a hacker can hide their code within your WordPress files to use to take over your website. Additionally, they can upload files, update plugins, read files, and inject posts.

Identify If You Use AMP for WP

By logging into your WordPress backend you can easily see if you are subject to this exploit.

Step 1: Enter the WordPress backend by going to yourdomain.com/wp-login.php in your browser.
Step 2: Login with your WordPress username and password and navigate to Plugins and click on Installed Plugins on the left-hand side of your screen.
Step 3: Scroll down through any installed plugins to see if you have Accelerated Mobile Pages within your list, followed by its version. Any version below 0.9.97.20 is still vulnerable and you’ll have to perform a few actions to protect yourself.
The Plugins section in WordPress will allow you to see if you are utilizing AMP.

Upgrade AMP – Accelerated Mobile Pages

Note: It’s recommended to backup your website before pushing any updates.

Step 1: Follow the steps above in the section “Identify If You Use AMP for WP” to login and locate your Plugins menu.

Step 2: Locate Accelerated Mobile Pages. If you are running an outdated version you’ll see a message providing you a link to update. Click “update now” to automatically update to the latest version.

 

In the WordPress backend click the "update now" link to protect yourself from the AMP hack.

Have You Been Hacked?

A site hack is possible even without noticing any visual differences to your site. For a closer inspection below are some of the characteristics of the AMP exploit.

  • Characteristics of the AMP hack:
  • External Calls to sslapis.com
  • New creation of WordPress admin user “supportuuser”
  • Post injections
  • Registered user can manipulate code
  • Code vulnerability in ajax hooks
    • ampforwp_save_steps_data
    • wp_ajax_ampforwp_get_licence_activate_update
    • wp_ajax_ampforwp_deactivate_license
    • wp_ajax_ampforwp_save_installer
    • wp_ajax_amppb_export_layout_data
    • wp_ajax_amppb_save_layout_data
    • wp_ajax_ampforwp_get_image

If have identified your site is compromised from above characteristics, you’ll want to remedy it immediately since other sites on the same server can potentially be affected.

  • Liquid Web customer can purchase a Malware Clean Up package
  • Manually remove the code from the infected files
  • Restore from a backup dated before October 20, 2018 (keep in mind this will still have the old version and your site will still be in danger).

As time goes by, more plugins will give way to more vulnerabilities but there are some proactive steps to ensure your site’s security. For insight into ways of protecting your WordPress site look into our article on the subject, The Best Ways to Protect Your WordPress Site.

 

An Overview of Managed WordPress

Reading Time: 3 minutes

WordPress is open source software for building unique and powerful websites! It is quickly becoming the easiest and most popular way to create blogs, business sites, portfolios, forums, memberships, and e-commerce websites. Continue reading “An Overview of Managed WordPress”

Managing code snippets in WooCommerce

Reading Time: 3 minutes

When working on a WordPress site, especially stores, you’ll likely reach a point where you need something custom. You might want to customize something that doesn’t have a true setting in WordPress? Or, you need to add a custom hook to modify something? Or, maybe you need to customize part of your WooCommerce store?

No matter the case, making code changes means you’ll need to know the right place to do that. In this article, we cover the best ways to get this done and some best practices.
Continue reading “Managing code snippets in WooCommerce”

How to Allow Traffic by Country in the CSF Firewall

Reading Time: 2 minutes

One of the most-requested features on cPanel servers is the ability to manage and filter traffic at a country level. With the ConfigServer Firewall (CSF) plugin in WebHost Manager, you can do exactly that. Continue reading “How to Allow Traffic by Country in the CSF Firewall”

How to Block Traffic by Country in the CSF Firewall

Reading Time: 3 minutes

One of the most-requested features on cPanel servers is the ability to manage and filter traffic at a country level. With the ConfigServer Firewall (CSF) plugin in WebHost Manager, you can do exactly that.

Country-level filtering in CSF uses the Maxmind GeoLite Country database to obtain CIDR (Classless Inter-Domain Routing) ranges for specific countries. Each CIDR range covers all the IP addresses assigned to that country. Continue reading “How to Block Traffic by Country in the CSF Firewall”

How to Prevent Being Hacked by the Cross-site Scripting Vulnerability in WP Super Cache

Reading Time: 1 minute

The popular WordPress plugin WP Super Cache has been found to have a cross-site scripting (XSS) vulnerability in versions prior to 1.4.4. On sites with outdated versions, it is possible for an attacker to take complete control of the WordPress site. Please note: this vulnerability only affects users which have installed WP Super Cache. However, if you are unsure if you use the plugin or not you should still take precautions to protect your site.

Thankfully, this is vulnerability is simple to address; version 1.4.4, available now, contains a patch.

This tutorial is very similar to our tutorial on updating any WordPress plugin: How To Update a WordPress Plugin

Continue reading “How to Prevent Being Hacked by the Cross-site Scripting Vulnerability in WP Super Cache”