Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that is correctly marked as spam, but cannot be removed from the admin dashboard by clicking Empty Spam or manually selecting the entry and trying to delete it.

I looked into this and noticed that the DB entry has a comment_post_ID of 0, which I'd have to assume means it is not attached to any post. I can obviously remove them manual from the DB (and it works just fine), but haven't found any information on what this could be.

I've replaced the core WP files (thinking it might be a security issue) and also re-generated the salts/keys in the wp-config.php file without any change.

Any thoughts would be a huge help. thanks!

Update

While this may have stemmed from, I'm not sure if it is the result of the InMotion hack.

Here's what's been done:

  • Changed FTP, MySQL passwords
  • Created new DB user, assigned to database
  • Updated salts/keys in wp-config.php
  • Changed all WP user passwords
  • Re-installed core WordPress files

Akismet is out of ideas on this one (don't blame them) as this one is persistent.

share|improve this question
1  
If a comment is posted without a post ID the ID is set to '0'. Look in /wp-comments-post.php. The next few lines should kill the script though, unless you have a post with ID '0'. And that is puzzling, which is why this is a comment and not an attempt at an answer. –  s_ha_dum Nov 7 '12 at 17:37
    
Yeah - this one's a head-scratcher for sure –  Zach Nov 7 '12 at 19:53
1  
Another idea. Grab the spammers IP from the DB and search for it in the server logs. Which url has the spammer requested? –  Ralf912 Nov 22 '12 at 21:08
1  
do a grep on comment_save_pre and see if there's a function that alters the data before it is saved. It's not possible to add a comment without an (open to comments) post number, so it has the be changed after reception. Some questions: Are there custom post types, do you use ajax to submit comments (plugins). Are you using captcha plugins. –  Patriek Nov 25 '12 at 19:25
1  
Hi all - appreciate the continued interest in this one. A few responses: No plugins that hook into either comment_id_not_found or comment_save_pre (did have a plugin called Easy Comment Uploads previously, but is unpublished and can't find original files - now using Comment Images). The access logs have yet to reveal any matches for these IP addresses (which also don't match), but searches confirm they are spam (if that wasn't obvious already ha). –  Zach Nov 26 '12 at 14:45
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.