This just in via WordFence email: Wordfence <email@example.com>
AJAX call creates a user named wpservices with the email firstname.lastname@example.org and the password w0rdpr3ss. With this user in place, the attacker is free to install further backdoors or perform other malicious activity.
Block these IPs in cPanel / IP Blocker:
yourservice.live – Hosts the script responsible for rogue administrator creation. Also associated with other malvertising scripts in earlier incarnations of this campaign.
adsnet.work – Hosts ad network scripts for redirection and popups.
Popular WordPress plugin JetPack locks you out of your WordPress site after updating. Although unexpected and therefore annoying, it is apparently JetPack and nothing more sinister. 
I already have been using two different plugins (not JetPack) to block brute force hacking attempts. This plus a possibly non-intuitive approach to controlling user credentials eliminated prior issues I had with break in attempts.
The message you get when you try to login looks more like a phishing attack after your site has been hacked: for me, this was scary – it looked like JetPack had been compromised. It is actually a clumsy way JetPack is trying to force you to turn on one setting, and easily solved.
I have no idea what happens if you go through all the nonsense to “sending yourself a special link” (doesn’t THAT sound trustworthy!) by entering your email (which does NOT make sense as WordPress ALREADY HAS YOUR EMAIL from your profile): This sounds very much like a hack and scam. Any upgrade requiring a settings change should simply send you an email immediately following the upgrade.
My approach to solving this problem, took two (2) minutes. Simply:
to log in to my hosting server and rename …./wp-content/plugins/jetpack to xjetpack, (WordPress will disable the JetPack plugin because it is now ‘not found’)
then again browse to my home page and again click login – login proceeds normally to login as an administrator
back on the hosting server rename …/wp-content/plugins/xjetpack back to jetpack
and finally in WordPress go to plugins and “Activate” the JetPack plugin, then click Settings under the JetPack plugin.
The screen capture below is the section of the Setting for JetPack that the plugin wants you to turn on, and it is turned on for you once you “Activate” the plugin again. TURN THIS SETTING OFF. Problem solved. You may resume working.
 “Brute Force” attacks are where a hostile system tries to guess your password through trial and error. This kind of attack is continuous – once a server is on-line criminal systems all over the planet try this constantly. If you have a username such as “admin” or “Bob” then it is merely a matter of time until they find the password (and you probably deserve to be hacked).
Detection of “brute force” attacks is generally agreed to look for more than one attempt to log in! For example, after 5 failed logins the server (or a WordPress plugin) would lock the account, sending an email to the address in the user’s profile. The user then knows a hack on the account has been attempted and the user must then take steps to reset the password in order to restore access.
The problem with this JetPack update is 1) it turns on the “security” feature without your foreknowledge and consent, and 2) it forces failure on every login attempt, not after some chosen number of failed login attempts. By failing all administrator login attempts regardless of their validity the feature becomes a liability.
I recommend that you 1) turn off the JetPack “Brute Force” protection feature until it works, and 2) use other mature plugins, such as WordFence, to catch brute force attacks and many other kinds of attacks, as one example, requesting a non-existing page. JetPack will likely detect and correct their error fairly soon as it is a very active plugin.
Apparently due to recent changes, WordPress blogs with All in One SEO will not automatically post to FaceBook. After some web searching and multiple test messages, the root cause seems to be the All in One SEO plugin not writing “og” tags right for FaceBook, so FaceBook refuses to post. Posting to FaceBook by clicking the Share button under the post works normally.
I am not sure how to fix this in All in One SEO, although my understanding is that this is a configuration error on my part. However, for now, disabling the All in One SEO plugin fixes the problem and scheduled posts are not automatically shared on FaceBook. The problem affected only sharing on FaceBook: sharing to twitter, G+, and LinkedIn continued to work fine.
Anyone have an idea why this happens, or how to fix it?
Theme in use is a child of XRAY v1.4.3 in WordPress 4.1. The only new file is a copy of category.php which has been edited to make only one pass for The Loop then show the previous_post_link(). The modified code is shown at the bottom of this article.
In the WordPress Codex Function Reference for previous_post_link() it says that previous_post_link() is called to provide a link to the prior post (chronologically). It says that the search can be limited to only posts in the same category as the present post by specifying TRUE for $in_same_term and the part of the taxonomy to keep the same in $taxonomy, which defaults to ‘category’.
will be restricted to the same category as the first post returned, and be the next most recent post — the post chronologically immediately before the post being displayed and in the same category.
I do not see how what I have is different from what is shown as the example in the Codex:
Text As Link, Without Post Title, Within Same Category
Displays custom text as link to the previous post within the same category as the current post. Post title is not included here. “Previous in category” is the custom text, which can be changed to fit your requirements.
<?php previous_post_link('%link', 'Previous in category', TRUE); ?>
This is all fine in theory but it does not seem to work because it is loosing the proper URL and subsequent posts are no longer restricted to the category “The Great Pudding Explosion”.
If I ask for a post from the archive it properly fetches the most recent post with the requested category: the URL of the page is
where category “tgpe” is under the parent category “story”. Clicking previous_post_link() does go to the previous post, however the new URL is
Notice that WordPress is no longer caring about category. Clicking the result of previous_post_link() again displays the next most recent post, from any category, considering date only, not restricted to the original category.
The relevant code in category.php in the xray child folder is:
Tracking it down, here is the problem.
The call to previous_post_link() eventually calls get_adjacent_post() in /wp-includes/link-template.php.
Going into function get_adjacent_post() the $taxonomy has the correct value, ‘category’, HOWEVER it calls get_adjacent_post_link() to find the next/prior post;
The URL returned does not include the necessary http://website.com/category/….. but looses that /category/ part that is needed in the URL for it to continue to work.
The get_adjacent_post_link() code (debugging comments added):
/** This filter is documented in wp-includes/post-template.php */
$title = apply_filters( 'the_title', $title, $post->ID );
$date = mysql2date( get_option( 'date_format' ), $post->post_date );
$rel = $previous ? 'prev' : 'next';
$string = '<a href="' . get_permalink( $post ) . '" rel="'.$rel.'">';
echo "\n<!--\n inside function get_adjacent_post_link line ".__LINE__."\n\$string='$string'\n-->\n";
$inlink = str_replace( '%title', $title, $link );
$inlink = str_replace( '%date', $date, $inlink );
$inlink = $string . $inlink . '</a>';
echo "\n<!--\n inside function get_adjacent_post_link line ".__LINE__."\n\$inlink='$inlink'\n-->\n";
$output = str_replace( '%link', $inlink, $format );
echo "\n<!--\n inside function get_adjacent_post_link line ".__LINE__."\n\$output='$output'\n-->\n";
Produces html code:
inside function get_adjacent_post line 1569
$query='SELECT p.ID FROM wp_posts AS p INNER JOIN wp_term_relationships AS tr ON p.ID = tr.object_id INNER JOIN wp_term_taxonomy tt ON tr.term_taxonomy_id = tt.term_taxonomy_id WHERE p.post_date < '2012-01-09 06:57:40' AND p.post_type = 'post' AND p.post_status = 'publish' AND tt.taxonomy = 'category' AND tt.term_id IN (87) ORDER BY p.post_date DESC LIMIT 1'
inside function get_adjacent_post_link line 1859
$string='<a href="http://jdnash.org/tgpe-part-3-big-boom/" rel="prev">'
inside function get_adjacent_post_link line 1865
$inlink='<a href="http://jdnash.org/tgpe-part-3-big-boom/" rel="prev"> Prior </a>'
So after clicking the link to go to the previous post in the same category, the result to make the link the next time looks like
inside function get_adjacent_post
inside function get_adjacent_post line 1525
inside function get_adjacent_post line 1569
$query='SELECT p.ID FROM wp_posts AS p WHERE p.post_date < '2011-12-18 15:02:24' AND p.post_type = 'post' AND p.post_status = 'publish' ORDER BY p.post_date DESC LIMIT 1'
<link rel='prev' title='Love' href='http://jdnash.org/love/' />
Which of course is wrong. The post with the slug "love" is not even in the category "The Great Pudding Explosion"
Microsoft has chosen to migrate their existing Live Spaces blogging functionality to WordPress.com to provide more features for their customers. We feel that this confirms our commitment to support WordPress in the business environment.
From a Windows Live Newsletter we received 10/23:
Dear Windows Live Spaces customer,
We are very excited to announce our collaboration with a premier and innovative blogging service, WordPress.com, to offer you an upgraded blogging experience. We’ll help you migrate your current Windows Live Spaces blog to WordPress.com or you can download it to save for later. On March 16th, 2011 your current space will close.
With the new release of Windows Live services, we’ve made a series of changes and improvements across our products. We chose to partner to provide our users with a fantastic blogging solution. However, we realize the changes will have an impact on you – this email aims to address any concerns you may have.
Why is this happening?
Our customers have asked for richer blog functionality including an integrated statistics system, continuous saving of drafts and improvements to spam-fighting technology. To deliver the best possible blogging experience, we are collaborating with WordPress.com to provide their free service to you. For those of you that already have a blog on Windows Live Spaces, we will make it easier for you to get started while helping you move what you’ve already built up on Spaces.
If you are on Microsoft Live Spaces, simply follow the directions in the email you also should have received. If you are not on Live Spaces but would like to begin benefiting from the functionality of WordPress then you can sign up on WordPress.com.