Hack

Have you reached out to your hosting provider?

this happened to me also today. i was able to figure out that the hacker updated all of my pages and added some malware scripts to every page.
If you are able to access your admin panel then go to your pages section and at the end of every page there will be scripts that are causing problem. remove them and update the pages.
Your website will be working fine

Me too. What to do after removing the script?

Hi

It happened to me. I cleaned up but it came again one day later, even websites with last version of WP, with Wordfence, Block Bad Queries, etc.
Does somene knows where it comes from ? Is it an injection ?

I have exactly the same! Do you know where is the source of this problem?

Yes exactly, it came back after one day of removing… i think it is an sql injection

Guys please share that which plugins and chrome extensions you are using so that we can figure out what thing is messing up with our websites.

Hi, we had the same problem.
We think at the moment that it is being caused by Advanced Access Manager.

Can you guys confirm you have the same plugin installed?
https://www.ads-software.com/plugins/advanced-access-manager/#description

Yes, I have this plugin too.

Yes i also have that plugin installed. But it is installed on all of my websites and i only have problem on one..

Remember, you must also delete the user in the database that this plugin has created.

I had this problem on websites that do not have Advanced Access Manager plugin and with no user created.

@banny83 the query isn’t working fine.. I have found more than 5500 occurrences of these scripts in my database

@banny83 Thanks, it worked fine after some adjustments. Thank you very much, now what should i do to prevent the future attacks

Yes, I have this Advances Access Manager too.
Was infected yesterday. And now again this morning.
I Have now deleted the plugin.

I have no user in the db.

Now what should i do to prevent the future attacks?

• This reply was modified 5 years, 2 months ago by maagaardweb.