How do you make sure that your WordPress blog is safe from the Blackhole exploit?


I got a mass email from one of our vendors warning that their WordPress blog had been compromised using the "Blackhole exploit" and that they apologized for any spam that may have been sent as a result. It didn't go into any details beyond that. We have a WordPress blog as well and I'm not sure how the Blackhole exploit works. Is this a widespread issue, and what should be done to ensure that our WordPress blog is safe?

Topic: Security
Answer this Question


2 total
Vote Up (15)

The first thing to keep in mind is that there is no threat from the Blackhole exploit kit to the vast majority of WordPress users that use  The vulnerability only exists when WordPress software has been downloaded and installed, and the websites are self-hosted.  So if you aren't hosting you WordPress site, this is not an issue.   The current wave of attacks seems to use an email requesting that you "verify your order" by clicking a link (sounds pretty familiar, eh?).  It can look pretty legit, but, as you probably expect by this point, you click on the link, you go to a website that attempts to install malware on your system.  The classics are classics for a reason, I guess.  


If you make sure to keep everything patched, have an updated anti-virus program...and don't click on links in emails.  You shouldn't have anything to worry about.   

Vote Up (13)

Here's a good article that explains it in detail:

Blackhole Exploit Kit Explained and WordPress

"WordPress is a powerfully constructed open-source blogging platform whose code is openly available to the public. Criminal enterprises around the world have dedicated massive monetary resources to discover, create and exploit weaknesses in the code used to create WordPress sites. The processing capability of WordPress sites is very sophisticated, and it is WordPress’ swift, robust communication capabilities that criminals seek to control and use to disseminate malware. Malware are programs that hackers create to steal information from the Internet public. The Blackhole Exploit Kit is an emerging malware threat that has affected thousands of WordPress sites. The threat posed by the Blackhole Exploit Kit and other malware can be reduced by taking a series of preventive measures that are collectively referred to as WordPress hardening."

Ask a question

Join Now or Sign In to ask a question.
A file-encrypting ransomware program called CryptoWall infected over 600,000 computer systems in the past six months and held 5 billion files hostage, earning its creators more than US$1 million, researchers found.
Former U.S. Secretary of State Hillary Clinton called for a "global compact" on surveillance and the use of collected data, saying the U.S. isn't the only country that does it and American technology companies are unfairly targeted for the government's actions.
Electric carmaker Tesla Motors wants security researchers to hack its vehicles. The Silicon Valley based high-tech carmaker will hire up to 30 full-time hackers whose job will be to find and close vulnerabilities in the sophisticated firmware that controls its cars.
Two recent vulnerabilities are examples of problems that could have been avoided if we had just applied the lessons already learned in similar contexts.
Windows XP users may now download a fourth service pack for the 13-year-old operating system, but it isn't coming from Microsoft.
The growing number of data breaches resulting in massive numbers of payment cards being stolen from retail stores and other businesses is occurring because they're failing to keep up with the Payment Card Industry's data security standard, according to the PCI Security Standards Council.
Email addresses and encrypted passwords of around 97,000 users who tested early builds of the Bugzilla bug tracking software were left exposed for three months following a server migration.
A U.S. Federal Bureau of Investigation spokesman said Wednesday the agency is working with the Secret Service to determine the "scope" of reported cyberattacks against several financial institutions.
A payment card industry security consortium warned retailers on Wednesday of the urgency to secure their systems against "Backoff," a malicious software program that steals card numbers.
Join us: