Max Sharlaev

It seems you can make language switcher work by disabling Yoast SEO metabox for taxonomies. It won’t solve terms description problem, but may be used as workaround.

• This reply was modified 8 years, 3 months ago by Max Sharlaev.

Andrew, yes, I’ve deleted this file. For now it seems all malware is cleared (catched the last one today – it didnt contain eval function, so I couldnt find it at once).

Benjamin Cool, thank you, I didn’t noticed that bot would go directly to /wp-admin/theme-editor.php . All other actions looks like bot activity (many files were created in random directories and certain line of code was inserted in random existing files).

I’ve checked users – there was no new administrators. I think attacker could use account of my colleague because I have a quite strong password.

I think I should reinstall WP and check theme files. Now I see peroidic POST requests to wp-login.php like somebody is trying to bruteforce my site. Hope security plugin will handle bruteforce well.

Andrew, I have already cleaned it up – at least what I could find (there was lots of files and code inserts). Now I am trying to understand how the attacker got in. And if it is possible – what exactly did he done.

Previous solution was no good because it breaks output of Events Manager content. So I found another one: do nothing with line 29, but add this code at line 110 after the closing brace:

else echo $page_content;

I’ve got the same problem while developing one of my projects.

The problem hides inside em-events.php in Events Manager plugin directory, at line 29 (EM version 5.5.2).

Here’s the code that causes conflict:
$content = apply_filters(’em_content_pre’, ”, $page_content);

And here’s the code that solves the problem at the moment:
$content = apply_filters(’em_content_pre’, $page_content);