While doing a a random Google search, I realized that my WordPress blog is populated with several spammy posts.
Ex: (intentionally delinked)
http://example.com/2016/02/06/free-download-wallpaper-ringtones-mobile/
http://example.com/2016/02/06/under-the-dome-seizoen2/
And many more such on the sidebar.
At first I thought my WordPress install was compromised, analyzing further I was at a loss..
- The posts are nowhere to be seen in my db(expected), neither on the filesystem as flat files or uploaded files(expected)
- I can't find any
eval()
orbase64_decode
done wrong, at least not at first glimpse - Even after changing the WordPress theme, these posts are served with the same theme as they were prior to the change.
I have:
- Scanned using Exploit scanner
- Checked for evals/base64_decode/php shortcodes etc as mentioned in WP Codex
- Added a comment on the footer and this doesn't reflect on the spammy posts, while it does on the 'actual' posts
- nginx access logs indicate the posts are being served from my server
So where are these posts being served from?