0

My wordpress site got hacked, I fixed the problem but had to delete the TwentyFifteen theme (the one that was hacked). The theme I was originally using was different, but the hackers hacked the TwentyFifteen theme. When I deleted the theme, I went back to the wordpress dashboard and see this:

enter image description here

As you can see it's not recognizing any theme and I can't activate them. Also the Homepage is blank. Any ideas on how to activate a theme via FTP?

Thanks

  • If a core theme was hacked I would contact with WordPress Security Team to report it. Please, do it. – cybmeta Mar 4 '16 at 7:12
1

Issue 1: Look at your dashboard; you're not logged in as an administrator, and as a result you don't have the privileges and can't activate themes or plugins.

With adminer or phpmyadmin, check your wp_usermeta table for your user and be sure the wp_capabilities key is for an admin: a:1:{s:13:"administrator";s:1:"1";}

Or, add a new admin via SQL:

INSERT INTO `*yourdatabasename*`.`wp_users` (`ID`, `user_login`, `user_pass`, `user_nicename`, `user_email`, `user_url`, `user_registered`, `user_activation_key`, `user_status`, `display_name`) VALUES ('999999', '*yourusername*', MD5('*password*'), '*yourfullname*', '*youremail*', '*http://example.com*', '2016-01-01 00:00:00', '', '0', '*yourfullname');

INSERT INTO `*yourdatabasename*`.`wp_usermeta` (`umeta_id`, `user_id`, `meta_key`, `meta_value`) VALUES (NULL, '999999', 'wp_capabilities', 'a:1:{s:13:"administrator";s:1:"1";}');

Replace *examples* with user name, real name, password (in plain text), etc. The user_id is set to 999999 to avoid collisions with existing user IDs.

Issue 2: Be sure you have carefully followed FAQ - My Site Was Hacked - WordPress Codex. You may not have done a complete job cleaning the hack. Then take a look at the recommended security measures in Hardening WordPress - WordPress Codex and Brute Force Attacks - WordPress Codex

  • Thanks for the quick response, I'll read those through. That is the administrator account so not sure what happened there. Any ideas how I can regain access through the backend? – Soulipsyz Mar 4 '16 at 4:11
  • Added some details; you need to use adminer or phpmyadmin to take a look at the database. – markratledge Mar 4 '16 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.