Support » Fixing WordPress » Possible Spam being sent from WordPress (possible bug)

  • I host a number of customers through a business of ours. Within the last 2 days I found, what I believe to be, wordpress being used to send spam emails. I have used the MailHeaders addon and few others to track down this spam and it always comes up leading to the main domain as such:

    Sun Jan 29 17:58:09 CST 2012 – /home/username1/public_html/ – username1 x 551 549 /home/username1 /usr/local/cpanel/bin/noshell
    Sun Jan 29 17:58:42 CST 2012 – /home/username2/public_html/ – username2 x 583 581 /home/username2 /usr/local/cpanel/bin/noshell

    X-PHP-Script: for (ip address)

    Return-path: <>
    Delivery-date: Sun, 29 Jan 2012 16:59:12 -0600
    Received: from mailnull by with local (Exim 4.69)
    id 1RrdiK-003PjM-38
    for; Sun, 29 Jan 2012 16:59:12 -0600
    Auto-Submitted: auto-replied
    From: Mail Delivery System <>
    Subject: Mail delivery failed: returning message to sender
    Message-Id: <>
    Date: Sun, 29 Jan 2012 16:59:12 -0600

    This message was created automatically by mail delivery software.

    A message that you sent could not be delivered to one or more of its
    recipients. This is a permanent error. The following address(es) failed:
    Domain domain has exceeded the max emails per hour (200) allowed. Message discarded.

    —— This is a copy of the message, including all the headers. ——

    Return-path: <>
    Received: from username by with local (Exim 4.69)
    (envelope-from <>)
    id 1RrdiJ-003PjJ-Mj
    for; Sun, 29 Jan 2012 16:59:11 -0600
    X-PHP-Script: for ip address
    Message-Id: <>
    Date: Sun, 29 Jan 2012 16:59:11 -0600

    wordpress seo

    I cannot cache these emails as they all seem to be sent to the same email address for some reason and thus they are going through until the hit the 200 email per hour limit.

    I am hoping someone will have some insight to this. This is happening with 2 different domains, but running wordpress and different plugins. If I rename the folder of the addon domain on one of these accounts that email is generating from, the spam emails stop completely. If I replace the correct name of the folder, the emails begin again.

    I have checked for mailing plugins and only one of the sites are running one and disabling it has no effect. So I am at a total lose here as to where these are generating from, but from the looks of things, they are coming form the wordpress itself.

Viewing 3 replies - 1 through 3 (of 3 total)
  • I have the same problem. SPAM emails are being sent from my WordPress website. My hosting company reported that those spams were sent trough these php files:


    @ andreirai

    What does you server log show?
    Is emails sent from a user/hacker?

    If you folders are correct, these files is not a part of WordPress:


    The following file should only be functional if “enable post by email” is on under Settings > Writing


    If you use the latest version of WordPress, maybe you could download a fresh copy and replace those files?

    @ Marbman21

    What WordPress files is used to send mail?
    What does you server log show?

    Have you checked for any unkown or modified files that a hacker may have placed on your server?

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Possible Spam being sent from WordPress (possible bug)’ is closed to new replies.