{"id":6297825,"date":"2015-07-05T17:08:07","date_gmt":"2015-07-05T17:08:07","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/wordpress-compromised\/"},"modified":"2016-08-30T15:10:06","modified_gmt":"2016-08-30T15:10:06","slug":"wordpress-compromised","status":"closed","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/wordpress-compromised\/","title":{"rendered":"WordPress cOmpromised"},"content":{"rendered":"<p>I don&#8217;t know how this happened, but I&#8217;m trying to figure it out.  <\/p>\n<p>Long story short, I tried logging into my wordpres admin area and god an error similar to this.<\/p>\n<pre><code>Warning: include(.\/wp-includes\/ms-bookmark.php) [function.include]: failed to open stream: No such file or directory in \/home\/*******\/public_html\/wp-config.php on line 81\n\nWarning: include(.\/wp-includes\/ms-bookmark.php) [function.include]: failed to open stream: No such file or directory in \/home\/******\/public_html\/wp-config.php on line 81\n\nWarning: include() [function.include]: Failed opening &#039;.\/wp-includes\/ms-bookmark.php&#039; for inclusion (include_path=&#039;.:\/usr\/lib\/php:\/usr\/local\/lib\/php&#039;) in \/home\/******\/public_html\/wp-config.php on line 81\n\nWarning: Cannot modify header information - headers already sent by (output started at \/home\/*****\/public_html\/wp-config.php:81) in \/home\/*****\/public_html\/wp-includes\/pluggable.php on line 1196<\/code><\/pre>\n<p>I did some digging and learnt the site has been compromised with some sort of javascript malware.  I was able to remove the line of code that prevented me from logging into the admin area -include(&#8216;.\/wp-includes\/ms-bookmark.php&#8217;); (which was initially in the wp-settings.php file).  This morning, that line of code is back but is now found in the wp-config.php file.  <\/p>\n<p>I&#8217;m thinking what this hack is now doing is deferring people to other websites.  I&#8217;ve noticed there area  a lot of outbound links found in my cpanel &#8220;latest visitors log&#8221; which show people visiting pages within my wordpress site that do not actually exist.  When you go to that link within my site you are forwarded to something else &#8211; and there hard hundreds of these links within my site that dont exist.<\/p>\n<p>Any ideas on how I can deal with this without having to completely destroy the site?  I keep it up to date very regularly.  I have Wordfence installed and every time an update is out for a plugin or WordPress, its updated on the same day.<\/p>\n","protected":false},"template":"","class_list":["post-6297825","topic","type-topic","status-closed","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6297825","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/6297825\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=6297825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}