casino spam in my wp_options on client_data_run

This problem is like a Pharhma Hack, with the same problem of spam on description:

https://www.pearsonified.com/2010/04/wordpress-pharma-hack.php
https://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html

I think that the problem is Akismet …

Googlebig have solved for me the problem

https://www.googlebig.com/2014/04/04/how-to-remove-verified-casino-spam-page-on-wordpress/

Have the same issue and managed to put together a short script that removes those entries. Place a PHP file in your WP root with the following contents and run it in your browser:

<?php
/** Loads the WordPress Environment */
require( dirname( __FILE__ ) . '/wp/wp-blog-header.php' );
global $wpdb;

$blogs_details = $wpdb->get_results('SELECT <code>blog_id</code>, <code>domain</code> FROM <code>wp_blogs</code> ORDER BY <code>wp_blogs</code>.<code>blog_id</code> ASC', ARRAY_A);
foreach ($blogs_details as $blogDetails)
{
    echo "<br />Checking ". $blogDetails['domain'] ." (#". $blogDetails['blog_id'] ."):<br />";

    $casinoFixFind = "SELECT * FROM <code>wp_&quot;. $blogDetails['blog_id'] .&quot;_options</code> WHERE <code>option_name</code> = 'client_data_run'";
    if ($wpdb->query($casinoFixFind)) {
            echo "Darn! Found entry here... ";
            $casinoFixRemove = "DELETE FROM <code>wp_&quot;. $blogDetails['blog_id'] .&quot;_options</code> WHERE <code>option_name</code> = 'client_data_run'";
            if ($wpdb->query($casinoFixRemove)) {
                echo "<strong style='color: green;'>Successfully fixed!</strong><br />";
            } else {
                echo "<strong style='color: red;'>SHIT!<br />ERROR</strong>: ". mysql_error() ."<br />";
            }
    } else {
        echo "<strong style='color: green;'>". $blogDetails['domain'] ." is clean!</strong><br />";
    }
} ?>

The script above goes through all your blogs, looks for option_name = ‘client_data_run’ in the options table and removes it when it finds it. Pretty straight forward.

What I need to understand though, is how this came to be?!? Is it a virus, is it a plugin, is it user fault, WP vulnerability? What?

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Anything less will probably result in the hacker walking straight back into your site again.

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

And next time, please post your own topic. This topic is 2 months old and references an old version of WordPress, so I am now closing it.