1

I do have a problem on my WordPress site. In the frontend there is a spam post (not a comment, a post) visible to everybody. I don't know where it comes from and all malware scans were negative so far. However, in order to solve this problem I will need to delete this post. But it can't be seen in the backend.

enter image description here

As you can see on the given screenshot the posts area shows "all posts" with the number of 58. However, when going through them via the pagination there are only 57. As I can't find the spam post via normal search methods I assume the spam post has somehow been hidden. There are no posts in the trash or whatsoever. I also checked pages, categories, tags, etc. but nothing.

Is there a way to remove it eventually?

Improve this question

2 Answers 2

Reset to default
1

I'd try

  • open the spam post in your browser and find the post ID. This will be in a rel='shortlink' tag in the HTML header:

    <link rel='shortlink' href='https://example.com/?p=123' />

    or as a class page-id-123 or similar on the body tag:

    <body class="page-template-default page page-id-123 logged-in admin-bar
             no-customize-support">

  • edit that ID into your normal edit post URL, e.g. 

    https://example.com/wp-admin/post.php?post=123&action=edit

You should then be able to edit or delete the spam post from there. If that doesn't work, look for that ID in the wp_posts table in your database and see if you work out why it's not showing up, or just delete it from wp_posts and wp_postmeta there.

Or if you want to see why the post counts differ, I'd compare the SQL queries WordPress is using to count the posts and list them, e.g. using the Query Monitor plugin.

Improve this answer
3
  • You, sir, are a genius! I would never have thought about that but it works. This way I could trash the post and it disappeared. Now "all posts" are 57 again, and 1 is in the trash. If I open the trash, there is nothing inside, so the post keeps being invisible. Any idea on how to empty the trash to fully get rid of it? If not, no worries. The main issue has been resolved and I am very thankful for that =)
    – UserSoUndSo
    May 14, 2020 at 9:03
  • :-/ I forgot about trash. I don't think you can easily construct a delete-from-trash URL the same way because they contain a _wpnonce parameter that's different for each post. The simplest way is probably using wp-cli wp post delete if you have that or can set it up?
    – Rup
    May 14, 2020 at 9:08
  • I am not familiar with that but I will look it up. Anyway, the main part was getting rid of this file in the frontend and if it is necessary it may rot in the trash. Thanks a lot for your help.
    – UserSoUndSo
    May 14, 2020 at 9:14
1

I've discovered that Wordpress will NOT show the posts in the Posts List (in wp-admin) if the post's user does not exist.

For whatever reason, my WP database does not have a foreign key constraint forcing a valid wp_user for every wp_post::post_author. I'm not sure if this is by design, or a hacker dropped the key constraint.

Regardless, if you do the following SQL command, you'll see a list of all the posts with a missing author:

select id,post_author, post_status, post_title from wp_posts where post_author not in (select id from wp_users);

Then I created a new "SirSpamALot" user and reassigned all the posts to that user.

update wp_posts set post_author=THE_NEW_USER_ID where post_author=INVALID_USER_ID;

And now I can see in the post list, and use the normal WP buttons to delete the posts.

Pretty dumb that wp-admin won't list the posts, but is quite happy to server the posts to visitors.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.