6

While doing a a random Google search, I realized that my WordPress blog is populated with several spammy posts.

Ex: (intentionally delinked)

  • http://example.com/2016/02/06/free-download-wallpaper-ringtones-mobile/
  • http://example.com/2016/02/06/under-the-dome-seizoen2/

And many more such on the sidebar.

At first I thought my WordPress install was compromised, analyzing further I was at a loss..

  • The posts are nowhere to be seen in my db(expected), neither on the filesystem as flat files or uploaded files(expected)
  • I can't find any eval() or base64_decode done wrong, at least not at first glimpse
  • Even after changing the WordPress theme, these posts are served with the same theme as they were prior to the change.

I have:

  • Scanned using Exploit scanner
  • Checked for evals/base64_decode/php shortcodes etc as mentioned in WP Codex
  • Added a comment on the footer and this doesn't reflect on the spammy posts, while it does on the 'actual' posts
  • nginx access logs indicate the posts are being served from my server

So where are these posts being served from?

5

Turns out, the WordPress install was indeed compromised. I did a diff of my existing install vs a new WordPress install, and diff reported new file:

# diff -qr wordpress_installed/ wordpress_new/

Only in wordpress_installed/wp-includes: class-wp-init.php

I also found wp-config.php had been edited to include this

@include_once(ABSPATH . 'wp-includes/class-wp-init.php' );

Fishy file indeed, this was what the file contained:

http://pastebin.com/Mr7N09Pq (linked to external because it kills Stack Exchange's syntax highlighter)

Removing the file & edited wp-config.php to remove out the include removed the spammy posts, for now.

I've also changed the db/user passwords and regenerated salts using this link.

next step would be to wipe out the Wordpress install, reinstall and restore from backup

  • 2
    You found your answer fast!! Very Impressive! I am glad you found the answer to your issue. Make sure that your install, themes, and plugins are up to date. Also check for vulnerabilities here: web.nvd.nist.gov/view/vuln/search?execution=e2s1 It is possible that there is an ongoing issue somewhere. As well, on shared hosts, other sites can effect yours so keep that in mind. Thanks also for posting an answer! I wish I could up-vote more. Cheers!! – closetnoc May 10 '16 at 21:14
  • 2
    @closetnoc hey, actually I have been working on cleaning this up for like 4+ hours, and I was updating the question with everything that I had done. I wanted to be thorough before someone asked "Have you done this?", so didnt submit till I was sure I'd handled it all, just then friend of mine noticed the diff result and hence was able to find the answer, so I posted it as self answer just as a pointer to someone else who might have this problem. Thanks for the link, I will check it – Sathyajith Bhat May 11 '16 at 5:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.