We’ve been getting hammered over the past few days by bots with banks of IP addresses scanning our WordPress db for vulnerability. We’re getting things under control, but in troubleshooting this, the following error has been popping up numerous times in the logs:

[Mon Jun 17 10:01:43 2013] [error] [client 111.223.131.87] WordPress database error Unknown column ‘usergroup_badge’ in ‘field list’ for query SELECT wp_1_sfmemberships.usergroup_id, usergroup_name, usergroup_desc, usergroup_badge, usergroup_joinntttFROM wp_1_sfmembershipsntttJOIN wp_1_sfusergroups ON wp_1_sfusergroups.usergroup_id = wp_1_sfmemberships.usergroup_idntttWHERE user_id=182 made by require(‘wp-blog-header.php’), require_once(‘wp-includes/template-loader.php’), include(‘/themes/wpmu-nelo-child/page-full-width-forums.php’), the_content, apply_filters(‘the_content’), call_user_func_array, sp_render_forum, sp_process_template, sp_load_template, include(‘/sp-resources/forum-themes/default-custom3b/templates/spTopicView.php’), sp_this_topic, spTopicView->__construct, spTopicView->sp_topicview_query, sp_get_user, spUser->__construct, sp_get_user_memberships, spdb_select

The ip address and user_id=x entry is bold because those seem to be the only two variables changing in all occurrences of the error. The requests are coming from numerous IP addresses.

Any help in deciphering and eliminating this error is greatly appreciated. Not sure if it’s even related to our recent rogue activity, but could use some help regardless trying to nail it.

Andy & Steve: You may recall I recently deleted a bunch of users, and some of heir metadata from sf tables using the queries we discussed a couple weeks ago. Could this error be caused in any way by the work I did to remove users from sf_members while keeping them in wp_users. For the record, in the case of the error above, user_id 182 is still an active sf_member and wp_user, and that is clearly not her ip address.

As usual, thanks in advance for any help!