Pages are hidden

Same thing happened to me last night around 11p.m. PDT… freaked me the hell out. The only reason I noticed is that I was actively working on one of my themes templates and went to check the home page and everything was out of whack, all of my plugins had been deactivated as well, and several pages I had created earlier in the day were now current posts on the home page and all pages on the manage page are no longer visible. Here is another thread that sounds similar: https://www.ads-software.com/support/topic/163187

yep all my plugins were turned off too. managed to correct most of it now but I found a php page on my site masquerading as a txt file which was scanning the server for everything and anything and also returning a phpinfo(). this was added as an attachment under wp_metadata() in my database.

a+
gar

I’m curious if you still have your default “Admin” account enabled or if you’ve removed it. I’m thinking the attack was based around a weakness in /wp-admin/options.php or a brute force on the Admin user… in my case the Admin user is enabled and the password is not the default created by wordpress, but is just as likely to be guessed.

same here, admin is still enabled but the password has been changed.

a+
gar

Just some more info for anyone this might have happened to over the last few days:

1) Check your server for a file named 3rbsmag.txt – it’s a php file masquerading as a txt file and it does many things like scan the server, return the phpinfo() etc. Delete it!

I don’t think you’ll be able to fix all the issues through the wordpress GUI you’ll have to go in and repair the database with mysql fixes (something like phpmyadmin will help a lot).

2) In your wp_posts table look for a post that has a link to the 3rbsmag.txt file (mine had loads of ../ in front of it). Delete it!

3) Back in the WordPress GUI go to Options > Miscellaneous and reset the upload path to its default or what you used before (again this is probably pointing to that 3rbsmag.txt file). Turn on the “Organize my uploads into month- and year-based folders” if you used it.

The issue is now corrected but you still have one large problem which is easiest to fix via mysql.

4) Everything in your wp_posts has probably been made into a post, so pages are no longer appearing on your site and in the wordpress GUI you can’t see your uploaded files anymore (even though they are all still in their posts). Easiest way to fix this is like this:

//these will fix all the images
UPDATE wp_posts SET post_type = ‘attachment’ WHERE post_mime_type = ‘image/jpeg’
UPDATE wp_posts SET post_type = ‘attachment’ WHERE post_mime_type = ‘image/gif’
UPDATE wp_posts SET post_type = ‘attachment’ WHERE post_mime_type = ‘image/png’

the same can be done for other attachments such as ‘application/x-shockwave-flash’ etc. just change the last bit of the sql query. The pages I think have to be done manually as they have nothing to identify them so you’ll have to go in and reset them as pages ether through mysql or in wordpress.

hope this saves someone a bit of time.