Latest WordPress Hack – Check your Permalinks, People!
I’ll type this without the normal pleasantries to make sure this gets out quickly.
There’s a WordPress hacker on the loose, and he’s pretty sneaky – he creates a user unseeable to the naked eye (except for the one extra user in the administrator users menu) and masks himself to you, making it easy for him to sneak in and out of the site and do stuff (like change your permalinks) without you knowing.
If your permalinks have some funky stuff going on, like this:
/wordpress %&evalbase64_decode_SERVERHTTP_REFERER.+&%/
then you’ve been hacked.
Head into your WordPress backend and click on “users” – there are ways to sort the users by their user role, so click on Administrator. You’re going to compare the number of administrators to the number next to the administrator tab.
If the two match, you’re OK.
If you see 3 grid lines, but the tab says Administrator (4), then you’ve got a hacker in your database.
Click on “View Source” and search the page for “user-1”. If you’re the only administrator, you’re looking for this code:
<div id=”user_superuser”>
This person is the hacker, and there’s a way to find him and delete him.
Your administrator account is user-1, so find a user around that code that’s not that one and nearby you’ll find a code:
user-edit.php?user_id=NNN
NNN is the user-id. I know these are vague, but without another account to screenshot, it’s hard to explain.
Replace the URL (http://youriste.com/wp-admin/whatever with http://youriste.com/wp-admin/user-edit.php?user_id=NNN and hit enter.
Enter a fake email address for the spammer, demote him to “Subscriber” and change his password.
Once that’s done, view all users and delete him.
And that’s how to get rid of him.
Better instructions are here: