While doing a a random Google search, I realized that my WordPress blog is populated with several spammy posts.
Ex: (intentionally delinked)
And many more such on the sidebar.
At first I thought my WordPress install was compromised, analyzing further I was at a loss..
- The posts are nowhere to be seen in my db(expected), neither on the filesystem as flat files or uploaded files(expected)
- I can't find any
base64_decodedone wrong, at least not at first glimpse
- Even after changing the WordPress theme, these posts are served with the same theme as they were prior to the change.
- Scanned using Exploit scanner
- Checked for evals/base64_decode/php shortcodes etc as mentioned in WP Codex
- Added a comment on the footer and this doesn't reflect on the spammy posts, while it does on the 'actual' posts
- nginx access logs indicate the posts are being served from my server
So where are these posts being served from?