Strange link to Casino Online appeared at the top of my blog

Log into your WordPress admin and go to “Appearance–>Editor”. Click on “header.php” in the list on the right. Try to see if you can locate this little snippet:

<small>online casino</p></center>

If you can see it in there then take it out. If not let us know, as it might be coming from within a plugin

As Jessn mentioned if you can’t find the content in the theme file, I would deactivate all plugins and then re-activated every single one, by one to find which one is responsible.

Found it, was a plugin: G Translate by benjilof
Thanks for the help ??

Thanks so much for reporting back! Turns out the same exact thing happened on one of my sites tonight, and I came back to check if you’d fixed it. Thanks to you I was able to quickly find the source (Google Translate) and deactivated the problem.

If anyone else has the same problem, I found the offending code inside of install.php

My site has the same issue! please help charlestonscrealestate.net is this a plugin?

Hi, I’m having the same problem at my site: shop.hsteele.com. I’m using WooCommerce and I can’t find the snippets in any of the files you mentioned here. Any ideas where to find the injection?

Thanks.

Try deactivating your plugins and then activate them one by one after refreshing your page and seeing if the lik apears. If you find that its actually wocommerce that is the problem then contact woothemes them, they’re usually very friendly ??

Thanks jessn- the code was at the bottom og install.php in the g translate plugin folder
How did they put it there ? the permissions are 644 – there are onlyn 2 users, both have 15 random character passwords

What can be done to prevent this happening again?

Hello, I am having the same problem but as I am not very good at programming and don’t want to damage this plugin as I still like it, can someone help on which part of the install.php needs to be deleted:

<?php
if (is_user_logged_in()) { $loggedin = ‘yes’; } else { $loggedin = ‘no’; }
if ($loggedin == ‘no’) {
$ip = $_SERVER[‘REMOTE_ADDR’];
$filename = $_SERVER[‘DOCUMENT_ROOT’] . ‘/wp-content/plugins/g-translate/owner.txt’;
$handle = fopen($filename, “r”);
$contents = fread($handle, filesize($filename));
fclose($handle);
$filestring= $contents;
$findme = $ip;
$pos = strpos($filestring, $findme);
if ($pos === false) {
?>
<p>online casinos</p>
<?php //
} else {
echo ”;
}}
?>

If you’re not confident editing code the easiest way is to totally delete the plugin, then upload and install a fresh copy.