possible hack attempt which seemed to “almost” work

Resolved

(@edwardsmark)

hello –

last night somebody managed to create several orders which did NOT show up when i look in

 wooCommerce->Orders

i spent a bit of time investigating, and it turns out its coming from India. we received several invoices with all zero dollar amounts. none of this activity reached Stripe as far as i can tell (fortunately). the only “proof” i could find of any activity was from our apache access_log below.

thoughts? i am going to block that IP number, but this seems like it could b some sort of backdoor security breach. any suggestions? or anything else i might want to consider?

124.253.186.183 – – [05/Sep/2025:00:27:33 -0400] “GET /checkout/order-received/3750/?key=wc_order_aV5CHLIoaByMa HTTP/1.1” 200 287394 “https://ajcomptonpesl.com/checkout/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”
124.253.186.183 – – [05/Sep/2025:00:28:46 -0400] “GET /checkout/order-received/3750/?key=wc_order_aV5CHLIoaByMa HTTP/1.1” 200 287540 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”
124.253.186.183 – – [05/Sep/2025:00:29:36 -0400] “GET /checkout/order-received/3751/?key=wc_order_wne9UGAnQ4hK0 HTTP/1.1” 200 287394 “https://ajcomptonpesl.com/checkout/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”
124.253.186.183 – – [05/Sep/2025:00:29:58 -0400] “GET /checkout/order-received/3751/?key=wc_order_wne9UGAnQ4hK0 HTTP/1.1” 200 287394 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”
124.253.186.183 – – [05/Sep/2025:00:30:11 -0400] “GET /checkout/order-received/3751/?key=wc_order_wne9UGAnQ4hK0 HTTP/1.1” 200 287540 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”
124.253.186.183 – – [05/Sep/2025:00:31:04 -0400] “GET /checkout/order-received/3751/?key=wc_order_wne9UGAnQ4hK0 HTTP/1.1” 200 287394 “-” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”
124.253.186.183 – – [05/Sep/2025:00:31:23 -0400] “GET /checkout/order-received/3752/?key=wc_order_V6hv8A2lKlcvp HTTP/1.1” 200 287394 “https://ajcomptonpesl.com/checkout/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”
124.253.186.183 – – [05/Sep/2025:00:46:36 -0400] “GET /checkout/order-received/3754/?key=wc_order_KIWGx1Bpy7H2S HTTP/1.1” 200 247907 “https://ajcomptonpesl.com/checkout/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36”

WordPress Environment<br><br>WordPress address (URL): https://ajcomptonpesl.com<br>Site address (URL): https://ajcomptonpesl.com<br>WC Version: 10.1.2<br>Legacy REST API Package Version: The Legacy REST API plugin is not installed on this site.<br>Action Scheduler Version: ✔ 3.9.3<br>Log Directory Writable: ✔<br>WP Version: 6.8.2<br>WP Multisite: –<br>WP Memory Limit: 2 GB<br>WP Debug Mode: –<br>WP Cron: ✔<br>Language: en_US<br>External object cache: – Server Environment<br><br>Server Info: Apache<br>Server Architecture: Linux 4.18.0-553.69.1.el8_10.x86_64 x86_64<br>PHP Version: 7.4.33<br>PHP Post Max Size: 8 MB<br>PHP Time Limit: 30000<br>PHP Max Input Vars: 1000<br>cURL Version: 7.61.1<br>OpenSSL/1.1.1k<br><br>SUHOSIN Installed: –<br>MySQL Version: 10.5.29-MariaDB<br>Max Upload Size: 8 MB<br>Default Timezone is UTC: ✔<br>fsockopen/cURL: ✔<br>SoapClient: ❌ Your server does not have the SoapClient class enabled - some gateway plugins which use SOAP may not work as expected.<br>DOMDocument: ✔<br>GZip: ✔<br>Multibyte String: ✔<br>Remote Post: ✔<br>Remote Get: ✔ Database<br><br>WC Database Version: 10.1.2<br>WC Database Prefix: wp_<br>Total Database Size: 249.17MB<br>Database Data Size: 242.28MB<br>Database Index Size: 6.89MB<br>wp_woocommerce_sessions: Data: 17.60MB + Index: 0.86MB + Engine MyISAM<br>wp_woocommerce_api_keys: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_attribute_taxonomies: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_downloadable_product_permissions: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_order_items: Data: 0.01MB + Index: 0.01MB + Engine MyISAM<br>wp_woocommerce_order_itemmeta: Data: 0.08MB + Index: 0.06MB + Engine MyISAM<br>wp_woocommerce_tax_rates: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_woocommerce_tax_rate_locations: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_shipping_zones: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_shipping_zone_locations: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_shipping_zone_methods: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_payment_tokens: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_payment_tokenmeta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_woocommerce_log: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_actionscheduler_actions: Data: 0.11MB + Index: 0.09MB + Engine MyISAM<br>wp_actionscheduler_claims: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_actionscheduler_groups: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_actionscheduler_logs: Data: 0.06MB + Index: 0.05MB + Engine MyISAM<br>wp_aiowps_audit_log: Data: 95.14MB + Index: 3.77MB + Engine InnoDB<br>wp_aiowps_debug_log: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>wp_aiowps_events: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>wp_aiowps_global_meta: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>wp_aiowps_logged_in_users: Data: 0.02MB + Index: 0.08MB + Engine InnoDB<br>wp_aiowps_login_lockdown: Data: 0.22MB + Index: 0.09MB + Engine InnoDB<br>wp_aiowps_message_store: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>wp_aiowps_permanent_block: Data: 0.02MB + Index: 0.02MB + Engine InnoDB<br>wp_commentmeta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_comments: Data: 0.07MB + Index: 0.04MB + Engine MyISAM<br>wp_e_events: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_draft_submissions: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_entry: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_entry_meta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_gf_entry_notes: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_form: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_form_meta: Data: 0.01MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_form_revisions: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_form_view: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_gf_rest_api_keys: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_links: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_litespeed_url: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_litespeed_url_file: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_nm_personalized: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_options: Data: 4.69MB + Index: 0.10MB + Engine MyISAM<br>wp_postmeta: Data: 78.03MB + Index: 0.80MB + Engine MyISAM<br>wp_posts: Data: 45.69MB + Index: 0.26MB + Engine MyISAM<br>wp_redirection_404: Data: 0.02MB + Index: 0.05MB + Engine InnoDB<br>wp_redirection_groups: Data: 0.02MB + Index: 0.03MB + Engine InnoDB<br>wp_redirection_items: Data: 0.02MB + Index: 0.09MB + Engine InnoDB<br>wp_redirection_logs: Data: 0.02MB + Index: 0.05MB + Engine InnoDB<br>wp_snippets: Data: 0.02MB + Index: 0.00MB + Engine MyISAM<br>wp_termmeta: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_terms: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_term_relationships: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_term_taxonomy: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_usermeta: Data: 0.03MB + Index: 0.01MB + Engine MyISAM<br>wp_users: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_admin_notes: Data: 0.05MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_admin_note_actions: Data: 0.03MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_category_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_customer_lookup: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_download_log: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_orders: Data: 0.02MB + Index: 0.02MB + Engine MyISAM<br>wp_wc_orders_meta: Data: 0.12MB + Index: 0.20MB + Engine MyISAM<br>wp_wc_order_addresses: Data: 0.02MB + Index: 0.02MB + Engine MyISAM<br>wp_wc_order_coupon_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_order_operational_data: Data: 0.01MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_order_product_lookup: Data: 0.01MB + Index: 0.02MB + Engine MyISAM<br>wp_wc_order_stats: Data: 0.01MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_order_tax_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_product_attributes_lookup: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_product_download_directories: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_product_meta_lookup: Data: 0.01MB + Index: 0.02MB + Engine MyISAM<br>wp_wc_rate_limits: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_reserved_stock: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wc_tax_rate_classes: Data: 0.00MB + Index: 0.01MB + Engine MyISAM<br>wp_wc_webhooks: Data: 0.00MB + Index: 0.00MB + Engine MyISAM<br>wp_wpfm_backup: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>wp_wpmailsmtp_debug_events: Data: 0.02MB + Index: 0.00MB + Engine InnoDB<br>wp_wpmailsmtp_tasks_meta: Data: 0.00MB + Index: 0.00MB + Engine MyISAM Post Type Counts<br><br>attachment: 80<br>custom_css: 2<br>elementor_library: 12<br>elementor-hf: 2<br>nav_menu_item: 18<br>oembed_cache: 1<br>page: 18<br>post: 3<br>product: 49<br>product_variation: 68<br>revision: 2722<br>shop_order_placehold: 68<br>wp_font_face: 33<br>wp_font_family: 12<br>wp_global_styles: 2<br>wp_navigation: 1<br>wpcode: 3<br>wpsc_cart_orders: 6 Security<br><br>Secure connection (HTTPS): ✔<br>Hide errors from visitors: ✔ Active Plugins (20)<br><br>All-In-One Security (AIOS): by TeamUpdraft<br>DavidAnderson – 5.4.2<br><br>Code Snippets: by Code Snippets Pro – 3.7.0<br>Elementor: by Elementor.com – 3.31.3<br>Essential Addons for Elementor: by WPDeveloper – 6.3.1<br>Font Awesome: by Font Awesome – 5.1.0<br>Gravity Forms: by Gravity Forms – 2.9.16<br>Ultimate Addons for Elementor Lite: by Brainstorm Force – 2.4.9<br>WPCode Lite: by WPCode – 2.3.0<br>LiteSpeed Cache: by LiteSpeed Technologies – 7.4<br>Quttera Web Malware Scanner: by Quttera team – 3.5.2.6<br>Really Simple Security: by Really Simple Security – 9.5.0.1<br>Redirection: by John Godley – 5.5.2<br>Side Cart WooCommerce: by XootiX – 2.7.1<br>Sticky Header Effects for Elementor: by POSIMYTH – 2.1.1<br>Checkout Field Editor for WooCommerce: by ThemeHigh – 2.1.4<br>Payment Plugins for Stripe WooCommerce: by Payment Plugins<br>support@paymentplugins.com – 3.3.92<br><br>WooCommerce.com Update Manager: by Automattic – 1.0.3<br>PPOM for WooCommerce: by Themeisle – 33.0.14<br>WooCommerce: by Automattic – 10.1.2<br>WP Simple Shopping Cart: by Tips and Tricks HQ<br>Ruhul Amin<br>mra13 – 5.1.9 Inactive Plugins (1)<br><br>WP Mail SMTP: by WP Mail SMTP – 4.6.0 Settings<br><br>Legacy API Enabled: –<br>Force SSL: –<br>Currency: USD ($)<br>Currency Position: left<br>Thousand Separator: ,<br>Decimal Separator: .<br>Number of Decimals: 2<br>Taxonomies: Product Types: external (external)<br>grouped (grouped)<br>simple (simple)<br>variable (variable)<br><br>Taxonomies: Product Visibility: exclude-from-catalog (exclude-from-catalog)<br>exclude-from-search (exclude-from-search)<br>featured (featured)<br>outofstock (outofstock)<br>rated-1 (rated-1)<br>rated-2 (rated-2)<br>rated-3 (rated-3)<br>rated-4 (rated-4)<br>rated-5 (rated-5)<br><br>Connected to WooCommerce.com: ✔<br>Enforce Approved Product Download Directories: ✔<br>HPOS feature enabled: ✔<br>Order datastore: Automattic\WooCommerce\Internal\DataStores\Orders\OrdersTableDataStore<br>HPOS data sync enabled: –<br>Enabled Features: analytics<br>marketplace<br>order_attribution<br>site_visibility_badge<br>remote_logging<br>blueprint<br>point_of_sale<br>custom_order_tables Logging<br><br>Enabled: ✔<br>Handler: Automattic\WooCommerce\Internal\Admin\Logging\LogHandlerFileV2<br>Retention period: 30 days<br>Level threshold: –<br>Log directory size: 18 KB WC Pages<br><br>Shop base: #35 - /shop/<br>Cart: #36 - /cart/ - Contains the &#091;woocommerce_cart] shortcode<br>Checkout: #37 - /checkout/ - Contains the &#091;woocommerce_checkout] shortcode<br>My account: #38 - /account/ - Contains the &#091;woocommerce_my_account] shortcode<br>Terms and conditions: ❌ Page not set Theme<br><br>Name: Astra Child<br>Version: 1.0.0<br>Author URL: http://wpastra.com/about/<br>Child Theme: ✔<br>Parent Theme Name: Astra<br>Parent Theme Version: 4.11.9 – 4.11.10 is available<br>Parent Theme Author URL: https://wpastra.com/about/?utm_source=theme_preview&utm_medium=author_link&utm_campaign=astra_theme<br>Theme type: Classic theme<br>WooCommerce Support: ✔ Templates<br><br>Overrides: – Admin<br><br>Enabled Features: activity-panels<br>analytics<br>product-block-editor<br>coupons<br>core-profiler<br>customize-store<br>customer-effort-score-tracks<br>import-products-task<br>experimental-fashion-sample-products<br>shipping-smart-defaults<br>shipping-setting-tour<br>homescreen<br>marketing<br>mobile-app-banner<br>onboarding<br>onboarding-tasks<br>pattern-toolkit-full-composability<br>product-custom-fields<br>remote-inbox-notifications<br>remote-free-extensions<br>payment-gateway-suggestions<br>printful<br>shipping-label-banner<br>subscriptions<br>store-alerts<br>transient-notices<br>woo-mobile-welcome<br>wc-pay-promotion<br>wc-pay-welcome-page<br>launch-your-store<br>add-to-cart-with-options-stepper-layout<br><br>Disabled Features: product-data-views<br>experimental-blocks<br>experimental-iapi-mini-cart<br>experimental-iapi-runtime<br>coming-soon-newsletter-template<br>minified-js<br>product-pre-publish-modal<br>settings<br>async-product-editor-category-field<br>product-editor-template-system<br>use-wp-horizon<br>experimental-wc-rest-api<br><br>Daily Cron: ✔ Next scheduled: 2025-09-06 05:20:07 +00:00<br>Options: ✔<br>Notes: 114<br>Onboarding: skipped Action Scheduler<br><br>Complete: 269<br>Oldest: 2025-08-05 20:15:22 +0000<br>Newest: 2025-09-05 17:23:31 +0000<br><br>Failed: 44<br>Oldest: 2024-05-09 08:07:21 +0000<br>Newest: 2025-09-05 04:26:05 +0000<br><br>Pending: 13<br>Oldest: 2025-09-05 18:23:31 +0000<br>Newest: 2025-09-18 22:40:39 +0000 Status report information<br><br>Generated at: 2025-09-05 17:43:04 +00:00<br>

This topic was modified 2 months, 2 weeks ago by edwardsmark.

Viewing 5 replies - 1 through 5 (of 5 total)

Plugin Support Frank Remmy (woo-hc)
(@frankremmy)

2 months, 2 weeks ago
Hi @edwardsmark,

Thanks for sharing such a thorough breakdown, especially the access logs and system report. That’s incredibly helpful for narrowing things down. It’s also good you caught this on time.

From what you’ve described, it does sound like someone may have attempted to exploit the checkout endpoint directly, possibly simulating order confirmations without going through the full WooCommerce order process. Since these orders (3750, 3754) didn’t appear in the WooCommerce dashboard and didn’t reach Stripe, it’s likely they were never properly created; just spoofed URLs hitting the “order-received” page.

From your server logs:
- The IP address repeatedly accessed /checkout/order-received/ with different order keys.
- These requests returned a 200 status, meaning the page loaded, but that doesn’t confirm a legitimate order was placed.
- The orders may have been placeholders or malformed attempt, possibly targeting vulnerabilities in custom code or plugins.
Here are my security and investigation recommendations:
1. As you mentioned, blocking 124.253.186.183 is a good first step.
2. Check if any suspicious user accounts were created recently.
3. Change all admin passwords immediately.
4. Check for any custom checkout or order-handling code (e.g. via WPCode, PPOM, or Code Snippets) that might be exposing endpoints without proper validation.
5. You have several security-related plugins installed (AIOS, Quttera, Really Simple Security). Make sure they’re actively scanning and logging suspicious behavior. You might also want to enable brute force protection and tighten access to sensitive endpoints.
6. Look in the wp_wc_orders table to see if these orders (3750, 3754) actually exist there
7. I see that WooCommerce logging is active. Consider reviewing logs under WooCommerce →Status → Logs for any anomalies around the time of the access attempts.
8. Your database includes shop_order_placehold entries. It’s worth reviewing those to see if any match the suspicious order keys.
9. Your PHP version is 7.4.33, which is end-of-life. Upgrading to PHP 8.3 or higher will improve security and performance.
10. If not already in place, a Web Application Firewall (like Cloudflare or Sucuri) can help block malicious traffic before it reaches your server.
I hope that helps. Let us know if you need anything else.
Thread Starter edwardsmark
(@edwardsmark)

2 months, 2 weeks ago

thank you for reply.

Your database includes shop_order_placehold entries. It’s worth reviewing those to see if any match the suspicious order keys.

may i ask where this is? i was unable to locate it.

Plugin Support shahzeen(woo-hc)
(@shahzeenfarooq)

2 months, 2 weeks ago

Hi there!

The shop_order_placehold entries are stored in your WordPress database, specifically in the wp_posts table (assuming your table prefix is the default wp_. it may be different on your site). These entries are typically orders with a post type of shop_order but with a status or placeholder that indicates they are not fully processed orders.

1. Access your website’s database using a tool like phpMyAdmin or via command line.

2. Look in the wp_posts table.

3. Run a query to filter posts with the type shop_order and look for any suspicious or placeholder statuses. For example

SELECT * FROM wp_posts WHERE post_type = 'shop_order_placehold';

That will show you any placeholder orders, and you can review whether their order keys match the suspicious ones.
Plugin Support LovingBro (woo-hc)
(@lovingbro)

2 months, 2 weeks ago
Hi @edwardsmark,

Good follow-up question. The shop_order_placehold entries aren’t something you’ll see in the normal WooCommerce → Orders screen. These are database records, and from your system report I can see the post type count shows:
```
shop_order_placehold: 68
```
That means your database currently has 68 rows of this post type.

To check them, you’ll need to look directly in the database (via phpMyAdmin or a tool like Adminer). Specifically:
- Open the wp_posts table (or whatever prefix your site uses).
- Search in the post_type column for shop_order_placehold.
- Each row there represents a placeholder order.
Sometimes these are created when an order process starts but isn’t completed properly. They shouldn’t normally show up in the admin area, which is why you couldn’t find them there.

If you want to dig deeper, you can cross-reference those IDs with the wp_postmeta table to see if any _order_key values match the suspicious keys from your logs (for example wc_order_aV5CHLIoaByMa).

Would you like me to outline the exact SQL query you could run to list these placeholder orders and their order keys, so you can quickly see if they line up with the suspicious traffic?
Plugin Support thelmachido a11n
(@thelmachido)

2 months ago

It’s been a while since we heard back from you for this reason we are closing this thread.

If WooCommerce has been useful for your store and you appreciate the support you’ve received, we’d truly appreciate it if you could leave us a quick review here:

https://wordpress.org/support/plugin/woocommerce/reviews/#new-post

Feel free to open a new forum topic if you run into any other problem.

Viewing 5 replies - 1 through 5 (of 5 total)

You must be logged in to reply to this topic.