clindsey

Thanks a bunch, I popped this change right into my child theme and it worked without (it appears) breaking the mobile-ready look. Thanks!

I think I found it. There is an additional file at /install/wp-includes/pomo/ The file is pm.php.

Rev. Voodoo, thanks for the links. I was posting so people can maybe figure out what the vulnerability is and maybe some other users won’t get hit by the same attack.

That said, I think I’ve found the damaging code. In wp-blog-header.php in the WordPress root folder, I found this at the top (link to WordPress pastebin)

Taking that out kills the redirects to the pharmacy site.

Followup: This doesn’t seem to be the Pharma Hack that was described recently. There are no added files in the Akismet plugin folder. None of the malicious code/entries were in my database.

Besides the config file and grp.php file I described above, the only thing out-of-place I see are some entries in wp-options. The first option in the table is _transient_random_seed. I don’t think I’ve ever seen that before, but I’m not sure, it could not be a sign of the hack. I also noticed entries for _transient_doing_cron and _transient_timeout_feed_mod_a5420c83891a9c88ad2a4f04584a5efc (and there were many similar to that last one).

I don’t see any strange posts in the database, and there are no additional users.

you might get mad at us for providing a free plugin (that others are selling for $150), supporting it and asking for some credit in exchange

Melvin, there are a lot of folks out there who provide great plugins that don’t embed links in a site without asking permission.

Still no update on this plugin?

Melvin, I apologize for any harsh feelings between us. I really like your plugin and utilize it, but I think the version on the WordPress plugin repository needs to be changed or removed as it pretty clearly violates the guidelines..

alexleonard, I utilize the FD Feedburner Plugin and I’ve noticed that PuSHPress doesn’t add the information for the local hub to my feed. My feed is here. Specifically, PuSHPress has added this code:
<atom10:link xmlns:atom10="https://www.w3.org/2005/Atom" rel="hub" href="https://pubsubhubbub.appspot.com/" />

Neither the developer or the “sponsor” of this plugin have responded for 6 days now (and they haven’t responded to the issue at all). I would ask that a moderator take a look at this plugin and ask the owners to make the link option turned OFF by default or remove the plugin. Again…

The Plugin Repository guidelines say:

The plugin must not embed external links on the public site (like a “powered by” link) without explicitly asking the user’s permission.

This plugin automatically adds a link in the footer of the public-facing website to the Web Design Company. There is an option to turn off the link (rather coyly), but by default, the plugin places the link in the footer of the public site. The plugin file with the link is /automatic-wordpress-backup/wdc/wdc.class.php.

Agreed. @melvinram, any response?

Melvin,

I don’t understand your post. What doesn’t seem right?

To me this seems pretty cut-and-dry: I install this plugin, activate it, and then a link appears on the front-page of my website. It doesn’t ask the user permission to show the link. The Guidelines specifically mention “Powered by…” links, which your plugin shows by default.

Mark,
Is something happening with this plugin/plugin author then? Or do I need to contact Dan? Thanks for the response.

I’m having the exact same problem, and I posted about it here.

Same deal as you. I have multiple installs, and only one is acting this way.

I really would appreciate some help on this!

FYI, I just reinstalled WordPress, and the same issues still exist.