Hacked: Hidden Links

This is not a solution, just sharing my experience-
Over two months worth of posts have disappeared from the web site. I have downloaded the XML file of posts and discovered that the missing posts were still in the file but that everyone had been infected with spam. The spam is in the form of hidden links to porn sites. I went through the file and deleted all the spam and then uploaded the file back to WordPress using the import posts utility. I thought that this might clear out the infected files by replacing them but this does not seem to have worked. By looking at the comment id, I can still load up the infected files. The porn links of course aren’t visible in normal view but if I view the source, they still appear. I would like – a) to get rid of the infected links and b) to replace the fifty or so posts with the cleaned up version without spending hours and hours in the process. The version of WordPress I am now using is 2.5.

The question is quite different than it’s posed here. You get hacked (fortunately I don’t have the experience). This can be done by a number of ways, such as a vulnerable site on a shared server, an insecure plugin or perhaps even a bug in WP itself. Then there are several kinds of hacks. What I think I read above it probably that your theme has been compromised, so if you upgrade to another WP but use the same theme with the infected files, nothing changes. If a hacker cracked your password (to WP, to your database, to your FTP server, your control panel, etc.) and you don’t change it, upgrading isn’t going to solve the problem. There’s a lot of things to think about when you get hacked. Screen your files, especially those that you want to use again, change passwords (ALL) to something hard to crack and most importantly “harden WordPress” ones you’ve got things clean again to prevent to be hacked again in the future.