gallamine

Any results on this? I’m having this issue too with my Author roles. Seems like a significant problem.

Ah ha! It was the “Redirection” plugin that was causing issues. Once I deactivated it, the homepage displayed the posts correctly.

I have read through all of https://codex.www.ads-software.com/Using_Permalinks and still no luck. I’ve deleted and recreated the .htaccess file. I’ve had WP create it for me – no dice.

If I choose any of the permalink settings other than Default, the home page doesn’t display the posts.

If I *disable* permalinks (set to default), everything works.
When I have it set to my original settings, “/%category%/%postname%/” it does not, and YES, I did modify the .htaccess file.

The main index.php template calls:


<?php get_header(); ?>
<?php get_sidebar(); ?>

<div id="content" class="narrowcolumn">

<?php if (have_posts()) : ?>

… which is identical to search.php which WORKS:

search.php

<?php get_header(); ?>
<?php get_sidebar(); ?>
<div id="content" class="narrowcolumn">
<?php is_tag(); ?>
<?php if (have_posts()) : ?>


samboll,

I did search around quite a bit trying to find this specific exploit. My searching skills failed, apparently. Thanks again for more links.

Ok, so I located a *.php file in my uploads directory. The little f’er disguised the ‘eval(base64_decode)’ by doing this:


$HtfCQGz='###########e####v#####a#l#(####ba####se#############6####4###_#########d##e###################c#########o##de####(#####\'ZXJy ...
...
str_replace('#', '', $HtfCQGz);
$XQRsCsV=create_function('',$HtfCQGz);$XQRsCsV();


In order to help find something like that I used the following linux command:


grep -R '.*b+.*a+.*s+.*e+.*6+.*4' * > output.txt


It searches for ‘base64’ with any text between the letters. Newlines can break it though, but it should be helpful for someone looking through their entire website structure.

samboll,

Actually, I want there to be a record of this specific problem, so that’s part of the reason for posting. 2nd link is new to me. thanks.

samboll,

read them. I want to understand what’s going on first.

I can delete the corresponding pages from the cache table, but then when I refresh the offending page, the items in the cache table reappars – it would then seem there’s some code that executing somewhere that’s regenerating them.

Ok, after more investigation it appears that the pages only live in the wp_cache table. I don’t know how they got there.
Some sort of cache poisoning or injection. I’ve searched around and I don’t find any information on this type of problem in WP 2.8.5 (or any versions, for that matter).

Anyone experienced this? Any idea how that could have happened?

I get the same error when I upgraded from 2.6 to 2.7. None of the RSS feeds in the Dashboard update/display.
Any ideas?

Yes, I changed that.

I found the answer, though. The problem was in the .htaccess file. I had forgotten to change the rewrite base to the new folder.

Evita, the homepage is ok, but the single pages are wrong.

Acutally, I discovered the problem – I wasn’t editing the correct file because WP is looking into the wrong directory for my themes. See this post I just made. Thanks.