WordPress Site redirecting to Adult Friend Finder

It sounds like your site is compromised.

So, I escalated this to my web host who is firm on asserting the issue lies with core WordPress files,

Sorta. When your site get’s compromised that’s often where the hacked files are modified or deposited. There’s no shortcut for delousing your site I’m afraid.

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

https://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html

You need to identify the door that the attacker came in via and shut that down.

But the files are all fresh from a clean download of the files here on www.ads-software.com and compared using known md5s. So you are saying that the host is right and www.ads-software.com is passing around compromised files? I am sure the good folks developing WordPress would be happy to hear that.

Edit: I am waiting to hear back from the head of the hosting company who believes the issue to actually be a compromise of Apache and not the WordPress files

Oh and the issue was still there on the same site with just a plain handcoded html file, so I don’t think the site was compromised.

So you are saying that the host is right and www.ads-software.com is passing around compromised files?

Ha! No.

*Drinks more coffee*

There are no known hacks for WordPress 3.9 and the files that are distributed are good and clean. Think of it this way: if it were the WordPress files then over a million installations would be compromised.

That would get noticed very quickly. ??

Your site was compromised. That could have been via an add-on such as a plugin or theme or your host is insecure. Host problems happen all the time sadly which is indicated by your comment like so.

Edit: I am waiting to hear back from the head of the hosting company who believes the issue to actually be a compromise of Apache and not the WordPress files

Running a secured host with only WordPress will not get you compromised. Sadly there are many situations where a password is captured or a host is compromised and that leads to many wasted hours.

It’s not easy to delouse a hacked site. Those articles I posted will help you locate and hopefully lock down your installation so this does not happen to you again.

Completely forgot to check back in and post the results. Turns out it was an sshd hack, which should have been fixed a year prior but apparently was not. Host patched and things have been working well ever since.