WordPress MU

Am using the latest version and someone keeps disabling all the plugins using links.

Here's the query

75.101.157.53 - - [06/Aug/2009:19:34:15 +0100] "GET /wp-admin//plugins.php?action=deactivate&plugin=wp-polls%2Fwp-polls.php&_wpnonce=1e33864d2c HTTP/1.0" 302 374 "http://site.com/wp-admin//plugins.php" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8"
75.101.157.53 - - [06/Aug/2009:19:34:15 +0100] "GET /wp-content/plugins/wp-post-thumbnail/js/wppt.js?ver=15231282 HTTP/1.0" 200 426 "http://site.com/wp-admin//plugins.php?deactivate=true" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8"
75.101.157.53 - - [06/Aug/2009:19:34:16 +0100] "POST /wp-admin/wp-content/plugins/wp-post-thumbnail/wppt_admin.php HTTP/1.0" 200 2408 "http://site.com/wp-admin//plugins.php?deactivate=true" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8"
75.101.157.53 - - [06/Aug/2009:19:34:16 +0100] "GET /wp-admin//plugins.php?action=deactivate&plugin=wp-sticky%2Fwp-sticky.php&_wpnonce=1e0dde082b HTTP/1.0" 302 374 "http://site.com/wp-admin//plugins.php" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8"
75.101.157.53 - - [06/Aug/2009:19:34:17 +0100] "GET /wp-content/plugins/wp-post-thumbnail/js/jquery.imgareaselect-0.5.1.min.js?ver=1276587253 HTTP/1.0" 200 9086 "http://site.com/wp-admin//plugins.php?deactivate=true" "Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8"
75.

`

Well, you could ban the IP for starters...

I have banned the ip and reported to amazon, as it's from there ec2.

Secondly for now I have protected the plugins.php file via htaccess. Though am not sure how secure is this.

So you're saying that someone who is not logged in can deactivate any plugin at will purely by calling the url?

That's my log. And that's not me. So how do i check who is this?

Do you store anything on ec2?

http://www.networksolutions.com/whois/results.jsp?ip=75.101.157.53

Nope i used to host website there, not anymore.

That ip is the one attacking.

I tested the second request with the 2.8.3 test version and it only works if the user is logged in. Have you changed you password since this started happening (and any password that has access to that blog)?

I have changed the admin password but not the others.

I have over 22,000 Users, but they are normal users.

This has not happened since i have put a password on plugins.php via .htaccess

But I don't see how it can be doing it if they're not logged in, and the nonce values should kill it stone dead because they are supposed to be issued, used once and thrown away.

I'm trying this on my 2.8.2 dev instance and can't reproduce it. I don't have the exact plugins mentioned in the OP, but with the ones I do have I replicate the basic structure, even including the nonce currently available in the url string from the deactivate link on a plugin from the plugins page. Doesn't matter if I'm a blog admin or site-admin. I just get the following (correct) error:

Your attempt to deactivate this plugin: “jquery-lightbox-for-native-galleries/jquery-lightbox-for-native-galleries.php” has failed.

pakigeek, have you done any mods to the core of your wpmu? Or use any plugins that opens up privs for users to post theme mods, unfiltered html/php, granular user role controls, etc?

Also, 22,000 users is huge! With that many users, it's a given that someone is going to try finding an exploit on your site and they'll probably succeed, which is why I'm interested to know what's happening here. If you do figure out why they can get past the built in role security and nonce keys, let us know.

I do have lots of users who are contributors though.

I know for sure the person who is doing this and that he has been trying for months to do something to the site.

I am using amember plugin with the site, when a user pays he comes a contributor. But a contributor does not have permission to do this either.

You can check the plugins i have installed @ http://www.pict.com/view/1426547/0/manage2520plugins252025e2258025b

Also i have audit trail plugin, according to it the person that's using that ip is abc123 who is a normal subscriber.

http://img2.pict.com/bc/91/60/1426551/0/800/audit2520trail252025e2258025b925.png

He seems to be loggin in from different ip's one of which is amazon ip.

The user seems to be normal user Here's what i got from the database

(364514, 23145, 'nickname', 'abc123'),
(364515, 23145, 'rich_editing', 'true'),
(364516, 23145, 'comment_shortcuts', 'false'),
(364517, 23145, 'admin_color', 'fresh'),
(364519, 23145, 'primary_blog', '1'),
(364520, 23145, 'source_domain', 'Site.com(replaced)'),
(364521, 23145, 'wp_1_capabilities', 'a:1:{s:10:"subscriber";b:1;}'),
(364522, 23145, 'wp_1_usersettings', 'm0=o&m1=o&m2=o'),
(364523, 23145, 'wp_1_usersettingstime', '1249278567'),
(382098, 23145, 'bb_topics_replied', '0');

"I know for sure the person who is doing this and that he has been trying for months to do something to the site."

Then mark his user as a spammer, or delete it, or ban it or something.