BuddyPress.org

The correct way is to sort out your email zone records, reverse PTR records, SPF records etc this is not a BP issue I’m afraid, nor a WP one.

I am helping Kathryn with this issue, here are the details for the installation.

The original programmer for the site vanished, so the configuration is the way it is. Not asking anybody to solve the problem on our behalf, just opening the issue to more eyes. All help and all input is greatly appreciated.

Wordpress: 3.5.2
Buddypress: 1.7.3
PHP: 5.3 (I suspect this might be the culprit.)

Installed Plugins
—
Legend – (A)Active, (-)Deactivated
—
BUDDYPRESS PLUGINS
—
(A)BP Auto Login on Activation 1.0.1
(A)BP Export Users 1.1
(A)BP Group Announcements 1.0.2
(A)BP Group Hierarchy 1.3.9
(A)BG Group Management 0.6
(A)BP Group Organizer 1.0.7
(-)BP Labs 1.3

(A)BuddyPress 1.7.3
(A)BuddyPress Activity Plus 1.5
(A)BuddyPress Auto Group Join 2.2.1
(A)BuddyPress Docs 1.4.3
(A)BuddyPress Docs Wiki add-on 1.0.3
(-)BuddyPress Edit Group Slug 1.2
(A)BuddyPress Group Email Subscription 3.3.3
(A)BuddyPress Groups Extras 3.5.7
(A)BuddyPress Like 0.0.8
(-)BuddyPress Live Notification 1.0.3
(-)BuddyPress Usernames Only 0.6
(A)bbPress 2.3.2
(A)bbPress reCaptcha 1.1
(A)bbPress Search Widget 2.0.0
(A)bbPress Threaded Replies 0.4.3
(A)GD bbPress Attachments 1.9.2
—
OTHER
—
(A)Akismet 2.5.7
(A)Automessage 2.3.1
(A)BackWPup 3.0.12
(-)Blog Categories for Groups 1.0.4
(-)Confirm User Registration 2.0.4
(-)Disable Comments 0.9
(-)downML – Download Media Library 0.3.1
(A)Email Users 4.4.4
(-)Fundraising 2.3.6
(-)Invite Anyone 1.0.21
(-)Live Stream Widget 1.0.4.2
(A)New RoyalSlider 3.0.93
(-)P3 (Plugin Performance Profiler) 1.4.1
(A)Plugins Garbage Collector 0.9.12
(A)Revolution Slider 2.3.8
(-)Scheduled Content 1.1.1
(-)Select Language At Signup 1.0.4
(A)SI CAPTCHA Anti-Spam 2.7.6.4
(A)Sidebar Login 2.5.3
(A)Simple Badges 0.1-alpha20120703
(-)Snapshot 2.3.3
(-)Tweet Blender 3.3.15
(A)Ultimate Maintenance Mode 1.5.0
(-)W3 Total Cache 0.9.2.11
(A)WordPress Importer 0.6.1
(A)WP-DBManager 2.63
(-)WP-reCAPTCHA 3.1.6
(-)WP Htaccess Editor 1.2.0
(-)WP UI – Tabs accordions and more. 0.8.7
(A)Yoast Breadcrumbs 0.8.5

Go to Settings > BuddyPress > Settings – Groups and remove ability of all users to create groups. Then, there’s also the BuddyPress Restrict Group Creation plugin which extends the capabilities but I’m not sure if it’s still compatible with current BP 1.7.2

This is the old thread but the same question, I didn’t want to spam here that’s why I will ask the same question here again, I would like to dynamically populate buddypress data into custom post types gravity forms when the user is logged in, I am succesfully populating wordpress user meta, but I don’t know the code in functions.php for buddypress profile fields to make them work, I have already asked on Gravity Help forum, but there are plenty of questions like that and the same as mine question they have never been answered, I hope that maybe somebody from this forum already had to resolve that problem in the past.

Are you on dedicated server or VPS ? if you are then by all means take a laissez faire attitude to your possible predicament, it’s your lookout, although be warned many exploits execute drive by code infecting the poor sods who happen across your site. If you are on a shared hosting service then your compromised site can possibly have comprised many other peoples sites if the server is not well hardened against intrusion.

The responsibility is overwhelming, if you are going to provide a route to passing on malicious code then you have to take all precaution to ensure you don’t, if you have your options are these you take your site off line ( protecting others ). You then change ALL access, usermanes, passwords, ftp, DB etc then you set about establishing whether you have actually been compromised (at this stage it’s not certain although likely) and it’s important to establish via logs and any other means what has happened not just to sweep under carpet and cross fingers it never happens again. Once you have identified issue cleaned up and reset all passwords then you may take site online again.

As for asking how they could have done x,y or z your asking non experts, ask an excerpt that sort of question and you would get short thrift from them, just assume that anything is possible because generally it is!

In regard that plugin where did you find it? Is it from the WP repo? As a rule of thumb be very very wary of plugins from unknown sources, the WP Repo is a pretty safe bet to avoid bad plugins other wise only accept plugins from third party sites that have some reputation amongst the WP community.

When you have finished last task ought to be checking the WP repo for further security plugins just so you have an arsenal at your disposal to keep an eye on things (wordfence might however be more than enough, but personally not familiar with it.)

getting hacked is a little bit like getting pregnant, theres no such thing as just a little bit. if they got in they have all of your access information, more then likely.

if i knew that a crook that had already proven interested in breaking into my house and had stolen my keys the very least i would do is to change the locks.

just saying…

fyi if your site has been hacked even on a low level you must clean it out and change all the associated admin and database passwords or you will be letting them right back in.

its still a bad sign that base 64 stuff is usually a sign of a open door that has been used to hack your site.

i think you should really check your site using that wordfence plugin as we both indicated having a user without an associated email is very suspicious.

Have you tried searching the WordPress plugin repository for something like ‘buddypress spam messages’?

A good plugin that will certainly resolve the issue is
https://wordpress.org/plugins/buddypress-private-message-for-friends-only/

Thank’s @ubernaut

@jconti keep up the good work!

@mareksgregs use this plugin:

https://wordpress.org/plugins/wordfence/

That plugin will check all core files.

Do you use WordPress simple or WordPress Multisite?