This is starting to become a big problem with many DAP websites being targeted. I’ve chatted personally with Veena, the author of the DAP plugin and she says the plugin is secure but I couldn’t help but notice other DAP issues surrounding the problems I had.
About 8 months ago, I was hacked every day for about 3 weeks straight. I didn’t know what to do and was so frustrated. It goes something like this:
- I wake up in the morning and get a DAP notification about a new user being created.
- I look in the system and sure enough the new user is there (and granted access), but I got no email from PayPal saying payment received.
- I go to DAP > Setup > Config > PayPal and sure enough there’s somebody else’s info in the PayPal email ID and token.
- I would change the info back to mine and things would be quiet for the rest of the day or two and then wake up the morning and the nightmare is repeated.
Basically somebody hacked into my website database and changed the PayPal email to his so that the payments go to him. In my case and seems to be with just about everyone else, the hacker was in China. Here’s someone else with Digital Access Pass being attacked by Chinese hackers.
So how do we fix the hacked DAP problem and prevent this?
What likely happened is the hacker got in from a PHP vulnerability either in DAP or any of the other WordPress extensions I was using. This could be another plugin, even a theme. If you have older plugins or themes, or even WordPress itself, that are not updated, you need to do it right away.
- Now to find out what the hacker did. There’s a good chance the hacker created php backdoor scripts to access your database. You can find these files hidden inside your many website directories. One thing you can do is view your server logs to see what files and folders were accessed. You can notice the hacker’s IP because he probably changed it to something that looks obviously fake. In my case, the hacker’s IP was 8.8.8.8.
- What I would recommend is opening up one of your older backups and comparing it with a current backup (where you’re having problems now). Look to see what new files are created and only exist now but didn’t exist before. In my case, it was a bunch of Adminer script files that he hid in many places. Inside a DAP directory, inside a plugin directory, among the wp-uploads directory, inside an unused template directory. The first time we checked, there was about 5 files. The second time we REALLY checked, there was about 15-20 files. Delete all these files.
- Check to see if he created new DAP admin accounts. When we deleted all his backdoors, my PayPal ID was still being changed to something else and so we realized he got hold of an admin account. What he did was give admin rights to one of the DAP customers. And then he used his account to gain access. We changed the password on the DAP user, as well as our own admin account, as well as WordPress admin and all database passwords. It’s a total hassle, I know.
My programmer started to lock things up on my site and the whole time I was asking him. “How did the hacker get in?” And the programmer said he was 100% sure it was DAP. I think he was able to see that from the server logs. The problem was that DAP files are encoded and so my programmer can’t see where the weakness is in the code.
While attempting to solve the problem, my programmer kept complaining to me about how he felt DAP was coded poorly or in a nonsensical way and that it simply wasn’t well-written software. He pleaded with me to use something else but I hated to let go of my beloved DAP.
Throughout this whole time, I was contacting DAP support and they couldn’t offer me much help because they didn’t feel the problem was their plugin. They said I had to buy an hour of paid support to look into the problem and that it might take more time than that. They blamed the vulnerability on other plugins or themes or anything but their own plugin. While I will never know if the problem is DAP or not, I can definitely see that their support will not help me troubleshoot should I ever get hacked again in the future.
It was at this moment that I decided to take the plunge and look elsewhere and man…I found there were so many new membership plugins nowadays. If you’re just starting to look around now, I would like to suggest to you the best one.
It’s called “MEMBERPRESS”, you can see my review on it here.
- Purchase it here through my affiliate link – www.memberpress.com
- Or read more complaints about DAP.
I’ve had a similar thing happen. I did want to say that Veena was VERY helpful to me and even wrote some software to send me an email when the email in the system setup was different from my regular email.
Hi Ellen, I’m glad they helped you. For the most part, DAP has been great support. Veena was always really nice and professional to me. The only issues came when I saw glaring flaws in their plugin which they refused to admit.
Having same issues, customer sent £47 to what I think is a Chinese email and after a week contacted me to ask why he hadn’t got access, of course no payment had been received.
Had issues before this with dap sending me messages saying a user had been changed to admin.
Have also had no end of issues with DAP ending peoples membership when they cancel future payments, despite having already paid for the current term, the login form refusing to display in the sidebar, the list goes on.
None of these issues have been dealt with by DAP and generally speaking the support has been terrible – they do respond but only if you’re paying them 40 dollars a month and then the responses are basically “its not our problem”.
Jonny – can you tell me – did you have to “nuke your site from above” or did you just delete DAP before installing a new member platform?
Hi Paul,
There is so little you can do about it. Please read my guide on Recovering from a HACKED web server. Honestly, you should have a developer or somebody you trust go through the server and clean out. There’s probably backdoors and everything. It was a nightmare. We had to change all passwords and what not. DAP is so incredibly vulnerable and you’ll never be able to fix due to its encrypted code. If you have server access, can check `last` command and see all the things the hacker was messing with. We migrated several thousand users to new platform (MemberPress) and never looked back. DAP is awful. So sorry for you, man. I know how it is.