Support » Fixing WordPress » Post.php keeps getting deleted somehow? Hacks / exploit?

  • Resolved philwinkel

    (@philwinkel)


    I have been having issues with a self-hosted wordpress site. Every few days, the /wp-includes/post.php file goes completely missing.

    edit- actually, it also happens to the wp-admin/includes/post.php as well.

    My site bombs because the wp-settings.php file does an include on post.php, and it no longer exists.

    It’s an easy fix, I just re-upload the missing files. But it seems very questionable that these files keep disappearing.

    I update to new wordpress versions ASAP. I have several third party security plugins (Sucuri, WordFence), I use LastPass to generate a new strong password each time, I have changed the wordpress table prefix to something other than wp_, etc. I have taken several security measures and it only seems to affect this one particular wordpress instance. (it gets hit by bots and brute force password attempts 24/7)

    I’m just wondering how and why this file keeps getting deleted. It happens several times per week. I change the password, ftp credentials, etc every single time. I have no idea how it continues to happen.

    I only use a few plugins:

    • WordFence
    • Sucuri
    • ChimpExpress – for mailchimp
    • MailChimp for WordPress light
    • UpdraftPlus – backups
    • Easy WP SMTP
    • Google ANalytics Dashboard for WP
Viewing 9 replies - 1 through 9 (of 9 total)
  • I am having exactly the same problem (post.php file disappears from wp-includes and wp-admin/includes every couple of days, breaking the site). I too, am able to temporarily fix it by overwriting the wp-includes and wp-admin folders, but it continues to happen.

    Yeah I have no idea what’s going on, it’s ridiculous. It has only happened to one of my many sites. I’m running them on Microsoft Azure and they have plenty of resources.

    I thought it was WordFence doing it’s scans at first. But I turned wordfence off, and it went for a couple days and just happened again.

    What type of server are you running wordpress on?
    Do you use any of the same plugins as I listed above?

    I already had to write a scheduled task that will check when the site goes down so I can fix it. I’m wasting tons of time with this thing.

    I’m literally to the point where I’m ready to write some code that just reuploads those 2 PHP files whenever the site goes down, LOL. This is absolutely ridiculous!

    Our site (my employer’s site) is on a simple HostGator business account.

    The only plug-in we have in common is Google Analytics Dashboard.

    Yeah, writing code to auto-upload the .php files beyond the scope of my skill set, but I am wasting an enormous amount of time with this as well. Hopefully we will get a response from someone useful soon.

    so today finally i was at work and browsed to the site and I got this error:

    https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mal~HTMLGen-A.aspx

    Still tyring to track down where it’s at though

    Ok, so i did a diff and it appears at some point the site was compromised, and a ton of rogue PHP files were littered all over the site. Backdoors presumably.

    I did a cursory sweep and deleted any obivous offenders, these PHP files all look like sketchy obfuscated code, so its pretty easy to spot.

    I’m hoping that kills it, but it seems like I may need to do a fresh install, migrate the data, reinstall all the plugins from official sources etc.

    Has anyone posted a solution to this hack? I restored the missing files and deleted all of the rogue PHP files and directories I could find, but three days later the post.php and plugin.php files are deleted again… help?! The site is hosted on GoDaddy.

    I used several different scanners,

    Sucuri scan
    Wordfence
    A third, which I forget, but it ultimately found the remaining files that the above scanners missed. I’ll edit this post if I can find it again..

    I also replaced all WordPress core files with fresh ones from the latest version of wordpress.

    Delete all your plugins and reinstall them from official sources.

    The malicious code copied itself all over. It was in WordPress core files, theme files, plugin files, etc. All over. They were pretty smart about parsing PHP and being tricky about where they inserted the code, it would often be in the middle of a file. If you do a mass diff of your WordPress core files, and your plugin core files, against official sources, you’ll probably see it all over.

    Then after that you might wanna think about anything confidential that was stored in WordPress config (your database connection info, other credentials) or database (users etc). Change all your passwords. Etc.

    Next time do backups with upgraftplus or something similar, take lots of backups at many intervals, retain them for a long time, so you can do diffs later and track down all changes made to the files in your site.

    Tldr; do a thorough / proper cleanup, reinstall plugins, themes, WordPress core files, etc from official sources. If you can’t do that, then get out some kind of diff tool and compare all the files on your filesystem to the official source files. Wordfence has a feature for doing this.

    THEN do post hack hardening, and take lots of backups.

    Thanks for the help

Viewing 9 replies - 1 through 9 (of 9 total)
  • The topic ‘Post.php keeps getting deleted somehow? Hacks / exploit?’ is closed to new replies.