Categories: WordPress 14 Comments »

I’ll type this without the normal pleasantries to make sure this gets out quickly.

There’s a WordPress hacker on the loose, and he’s pretty sneaky – he creates a user unseeable to the naked eye (except for the one extra user in the administrator users menu) and masks himself to you, making it easy for him to sneak in and out of the site and do stuff (like change your permalinks) without you knowing.

If your permalinks have some funky stuff going on, like this:

/wordpress %&evalbase64_decode_SERVERHTTP_REFERER.+&%/

then you’ve been hacked. 

Head into your WordPress backend and click on “users” – there are ways to sort the users by their user role, so click on Administrator.  You’re going to compare the number of administrators to the number next to the administrator tab.

If the two match, you’re OK.

If you see 3 grid lines, but the tab says Administrator (4), then you’ve got a hacker in your database.

Click on “View Source” and search the page for “user-1”.  If you’re the only administrator, you’re looking for this code:

<div id=”user_superuser”>

This person is the hacker, and there’s a way to find him and delete him.

Your administrator account is user-1, so find a user around that code that’s not that one and nearby you’ll find a code:

user-edit.php?user_id=NNN

NNN is the user-id.  I know these are vague, but without another account to screenshot, it’s hard to explain.

Replace the URL (http://youriste.com/wp-admin/whatever with http://youriste.com/wp-admin/user-edit.php?user_id=NNN and hit enter.

Enter a fake email address for the spammer, demote him to “Subscriber” and change his password.

Once that’s done, view all users and delete him.

And that’s how to get rid of him.

Better instructions are here:

http://blog.nachotech.com/?p=125

  • Saved my bacon. Thanks.

  • Saved my bacon. Thanks.

  • alergia

    Hi, great post and great blog.
    I have discovered your blog an it´s really interesting and usefull.

    thank you for sharing

  • Anonymous

    Hi, great post and great blog.
    I have discovered your blog an it´s really interesting and usefull.

    thank you for sharing

  • alergia

    Hi, great post and great blog.
    I have discovered your blog an it´s really interesting and usefull.

    thank you for sharing

  • really useful – thanks for sharing

  • really useful – thanks for sharing

  • really useful – thanks for sharing

  • really useful – thanks for sharing

  • Pingback: Wordpress Malware Removal Tool()

  • I think this hacker must still be on the lose. Thanks for this info. I need it.

  • I think this hacker must still be on the lose. Thanks for this info. I need it.

  • CyberWp

    Thanks Great Articles!! This website is WordPress Themes & Plugin Directory site! Please check! http://cybercloud.biz

Let's Get Started!

Ready to start a project with Mitch? Fantastic! Simply fill out the form below and Mitch will get back to you as soon as he's able!

(Please do not contact me about advertising requests or sales pitches unless you have been invited to do so).

Navigation


Contact