what version of wordpress are you using?
what plugins have you got on your site? (active and deactivated)
what theme are you using?
Using WordPress 4.0
Theme is salient
Plugins as follows- Cant tell from dashboard which ones from active as they are missing from dashboard. I have marked next to them which ones I think were inactive
calculated-fields-form
contact-form-7
google-analytics-for wordpress
html-javascript-addre
really-simple-captcha
w3-total-cache – inactive
woocommerce – inactive
woosidebars
wordpress-seo-premium
The set up had been working up until I tried to add “Visitor Maps and Who’s Online” plugin
If you are able to suggest a fix it would be greatly appreciated
I added Askimet last night and it appears on my dashboard as normal
cool.
woosidebars hasn’t been updated in over a year so maybe try deleting that to see if that makes a difference.
i can’t help thinking it’s the theme that’s the problem, have you contacted themeforest to reach the developer of that theme to see if there’s anything that they can recommend?
Hi,
Could you perhaps upload one of those plugin folders for me somewhere?
I’ve seen something similar happen before, and the files had lost their plugin detail lines and needed to be re-uploaded that time, but I’d like a copy of one of them to look into why it might have happened.
Hi Marius
I zipped the contact form 7 plug in folder and uploaded it.
http://www.vulcanbiomass.co.uk/wp-content/uploads/2014/11/contact-form-7.zip
Hope you can shed some light on this
Hi,
I’m sorry to say, but I was correct in my presumptions, and your site has been exploited.
I would recommend restoring backups form before the incident happened, and then updating all your themes/plugins right after doing so.
I have been coming to the same conclusion myself and been discussing with my host some assistance in carrying out this work.
I had everything up to date. Any idea how this could happen and how I can prevent it happening again?
Thanks for looking into this for me.
What themes do you currently have installed on your site? (Including inactive ones) ?
I have now installed a fresh wordpress reinstalled the Salient theme and reinstalled the plug ins. Back up installed and all is well apart from a couple of very minor styling issues.
Prior to being hacked I was running salient and had twenty fourteen inactive. Presently running salient with twenty twelve, twenty thirteen and twenty fourteen inactive.
I’m unfamiliar with that theme, so I can’t comment on it I’m afraid, but it’s the “odd one out” being the only premium feature on the list of things you had running so I would at least consider running the Sucuri scanner (https://wordpress.org/plugins/sucuri-scanner/) on your site now that the backup is up at least.
