Home › Forums › Newsletter Plugin Support › Spammers using the newsletter plugin widget for spam subscriptions
- This topic has 12 replies, 8 voices, and was last updated 4 years ago by
Anonymous.
-
AuthorPosts
-
October 22, 2019 at 10:05 am #242246
nfnf-de
ParticipantHi there,
since yesterday we are regularly receiving spam subscriptions via the Newsletter Plugin Widget. As we could find out, they are not using the form fields but are accessing the routine directly over [url]/?na=s, then it seems as if they are setting name, forename and email as post variable.
As this code is the same for every user of the Newsletter plugin it they most likely can use every installation of this plugin for making spam subscriptions.
For the time being we had to deactivate the plugin, as we can’t change the code of the widget.
We would suggest to create an individual token for the subscription link (../?na=s) for every installation of the Newsletter plugin. That would make it more difficult for them to access the subscription routine automatically.
We would love to reactivate the Newsletter Plugin as this is a great tool!
Many thanks in advance!
October 22, 2019 at 12:40 pm #242263Stefano
KeymasterHi, try to enable the captcha on security page and/or filter by ip or by domain name if they are using the same email address domain.
Stefano.
October 22, 2019 at 1:23 pm #242266nfnf-de
ParticipantHi Stefano,
thank you so much for your fast reply!
The captcha was enabled when the spam subscriptions came in and unfortunately they are using different IPs and Email addresses each time.
I think this post has the same problem:
https://www.thenewsletterplugin.com/forums/topic/a-bunch-of-spam-subscriptions-how-can-i-use-a-captcha-or-recaptchaIs there anything else we could do?
Many thanks in advance!
October 22, 2019 at 5:37 pm #242277Barclay Berger
ParticipantI had same thing happen, i had no idea they could do this. Is there a way to disable users to subscribe. I manually add my users to the list. This seems like a huge security hole
October 22, 2019 at 8:13 pm #242279Anonymous
InactiveWe had this today as well…
Worryingly, the Newsletter Plugin seems to have sent out emails, with the first line of our welcome email changed. The first line reads, “Hi ANNUAL DRAWING OF PRIZE FOR E-MAIL USERS – http://www.ugomezatydod.tk/b30356_prize2019_30356,”
I think the plugin has sent 100s of emails inviting people to click on this phishing site – from our email address.
God knows the GDPR implications of this!
We tried adding the captcha but the spam kept on coming. Have had to disable the plugin.
Can you advise?
October 22, 2019 at 8:54 pm #242282nfnf-de
ParticipantWe found a workaround for this.
As the spammers are targeting [url]/?na=s, you have to change this in the code of the plugin.
This is for advanced users only! You have to be very careful when changing files of the plugin itself!To change it, go to the following files in the plugin folder of your wordpress installation, search for ‘s’ (case sensitive!) and change it to ‘sub’ or whatever you want:
/newsletter/widget/minimal.php
/newsletter/subscription/subscription.php
/newsletter/includes/module.phpWe have reactivated the plugin this afternoon and until now there were no further spam subscriptions…
October 31, 2019 at 4:48 pm #242843ahardy42
ParticipantHi, I have just finished setting up the newsletter plugin and I came across your post. I can see how spammers could have abused the URLs to add fake subscribers, but I don’t understand how they managed to hack the plugin so that it sent out the spam newsletter and phishing URL.
Isn’t that part of the plugin API protected by your wordpress account authentication?
It’s great that you posted a work-around for the fake account subscribe actions. Isn’t your site still vulnerable though, because the spammer just has to reregister themselves on your newsletter and the process emails will show them the work-around URL query parameters?
Thanks and good luck!
November 4, 2019 at 1:32 pm #243023ahardy42
ParticipantIt would be helpful to have a statement from Stefano or the Newsletter plugin team about this msg from Wakeyjakey in this thread above:
Worryingly, the Newsletter Plugin seems to have sent out emails, with the first line of our welcome email changed. The first line reads, “Hi ANNUAL DRAWING OF PRIZE FOR E-MAIL USERS – http://www.ugomezatydod.tk/b30356_prize2019_30356,”
I think the plugin has sent 100s of emails inviting people to click on this phishing site – from our email address.
November 10, 2019 at 10:53 pm #243299Benjamin Bernard
ParticipantI am having a problem with spammers as well… Just found out one of my emails in on 3 black lists…. ouch..
Has this been patched? Is there an update?
Google reCaptcha v3 is a must these days… This math question seems like it could be manipulated easily
November 13, 2019 at 10:03 am #243484Anonymous
InactiveHi!
Is there the way to block subscription with specified name/surname? I use a simple form containing just an e-mail field and want to block spammers POSTs with filled name/surname variables.I tried to modify the next functions but it did’t help (maybe I haven’t enought skill):
- get_form_javascript() in /subscription/subscription.php
if ($options_profile['name_status'] == 2 && $options_profile['name_rules'] == 1) { //$buffer .= ' if (f.elements["nn"] && (f.elements["nn"].value == "" || f.elements["nn"].value == f.elements["nn"].defaultValue)) {' . "\n"; $buffer .= ' if (f.elements["nn"] && (f.elements["nn"].value == "" || f.elements["nn"].value !== "" || f.elements["nn"].value == f.elements["nn"].defaultValue)) {' . "\n"; $buffer .= ' alert("' . addslashes($options_profile['name_error']) . '");' . "\n"; $buffer .= ' return false;' . "\n"; $buffer .= ' }' . "\n"; } if ($options_profile['surname_status'] == 2 && $options_profile['surname_rules'] == 1) { //$buffer .= ' if (f.elements["ns"] && (f.elements["ns"].value == "" || f.elements["ns"].value == f.elements["ns"].defaultValue)) {' . "\n"; $buffer .= ' if (f.elements["ns"] && (f.elements["ns"].value == "" || f.elements["ns"].value !== "" || f.elements["ns"].value == f.elements["ns"].defaultValue)) {' . "\n"; $buffer .= ' alert("' . addslashes($options_profile['surname_error']) . '");' . "\n"; $buffer .= ' return false;' . "\n"; $buffer .= ' }' . "\n"; }
- newsletter_check(f) in /subscription/validate.js
//if (!newsletter_check_field(f.elements["nn"], newsletter.messages.name_error)) return false; //if (!newsletter_check_field(f.elements["ns"], newsletter.messages.surname_error)) return false; if (f.elements["nn"].value !== "") { alert(newsletter.messages.name_error); return false } if (f.elements["ns"].value !== "") { alert(newsletter.messages.surname_error); return false; }
November 14, 2019 at 10:39 am #243574Anonymous
InactiveLooks like I found the solution for me.
Maybe it will help for someone else – You need to add the next code to the top of the function subscribe($status = null, $emails = true) in /subscription/subscription.phpif (isset($_REQUEST['nn']) || isset($_REQUEST['ns'])) { die('Wrong registration data'); }
November 26, 2019 at 2:27 pm #244001Stefano
KeymasterHi guys, I’m sorry if you’re experiencing those subscription spam problems. I would recap how we protect the blog from spam subscriptions and how they try to use the subscription to spam.
First, they subscribe using as first name or last name an URL or something which resemble an URL (word[dot]word[dot][word). Email clients to help people automatically transform those texts which ARE NOT link in our email in active links.
So, first of all, you should remove the {name} and {surname} tags from your confirmation and welcome emails. Anyway, subscription are not accepted when the first name or last name contains “http://”. Of course the security option “antibot” should be enabled. Almost surely in next release we made those checks required.
After those checks we do an antiflood check to avoid multiple subscriptions from the same IP address. Then we send all subscription data to akismet to have a spam rating.
Again, all those check are applied if the security panel has the antibot option active (and yes, you’re right, the wording needs absolutely to be reviewed!).
The subscription is accepted only if it is and HTTP POST and there is an intermediate hidden form with a nonce.
So, to help us in fighting those spammer, update to the latest Newsletter version, check the security panel settings and look at the spam subscriptions: the should be very limited.
We’re even introducing a subscription block on names pattern like the one above (word[dot]word[dot]word).
Thank you for your collaboration, Stefano.
August 12, 2020 at 8:38 am #256953Anonymous
InactiveI have recently started getting spammers making subscription requests through Newsletter Plugin on my site. Please consider integrating Google’s reCaptcha into the subscription process; I have previously used it with a different plugin and it never let a single spam request through.
- get_form_javascript() in /subscription/subscription.php
-
AuthorPosts
- You must be logged in to reply to this topic.