Visual Editor & Bunch of Post Buttons Not Working After 4.0

Hi there, I have not gone to them yet, as I found one more bad php file hidden in a _MACOS folder. I deleted it and cleaned the code again, now I’m just waiting to see if it returns..nothing so far ??

Ok. I ended up going with them. They found a few malware codes in php files which I missed. Seems it may have been a mailpoet vulnerability.. that was somehow only unleashed when I updated to 4.0.

Do you use mailpoet?

Yes I do, on both websites. I’d have to agree, it was the mail poet folder which had the most bad javascript files. Hopefully it’s all sorted now. Goodluck with your website ??

Hey, @paperkawaii, just wondering if you’re still faring good with your sites?

I had a hard time with mine. We restored a backup from over a month ago, then I had Sucuri check it. They found a few pieces of malicious code but cleaned it up good. Later that night – bam – malware is back.

So then I restored backup again but password-protected the whole site from beginning – then deleted all plugins and updated to 4.0. Then I removed password protection, and now just have my basic wordpress with a couple security plugins installed, that’s it. Sucuri checked again and didn’t find anything, so that good. I think I had to blow away those plugin files.

I’m going to start adding back my plugins one at a time now, giving a couple days in between each.

So you’re running MailPoet on 4.0 without issues now?

Nervous, but fingers crossed!

I’ve had a bizarre experience…

The malware hasn’t come back after I deleted the extra php files.

But weirdly, securi scan found malware on two other websites on my hosting, which I was just about to go and clean today. But the malware is gone, with no injected code, no weird php files.

I’m thinking that perhaps the hosting company was at fault and had to remove the malware. Its Godaddy.

Anyway it is gone from mine and hasn’t come back, Mailpoet is installed on both sites.

When you put your plugins back I’m sure you already know, reinstall them from new copies.. I had it come back after uploading a plugin which wasn’t a new copy, I had to go back to codecanyon where I’d bought it and download a new copy.

Good luck, hope it stays away!