[Priority] Possible WordPress Vulnerability

I am trying to track down what appears to be a pretty widespread and serious vulnerability in either wordpress, or a configuration of word press.

For the second time in just a few months, I have had blocks of html injected into posts on my site. See [fn:1] for the exact text of what is being inserted.

This installation is currently running wordpress 3.9, which, although
is not the most current (the current version is 3.9.1), is still very much current.

The database server has the user accessing the database set to localhost only.

The most curious thing is, if you google any of these links as plain text, there is an abundance of pages linking to these pages. Each of the google hits on these is a wordpress site that seems to have suffered the same attack.

Looking at other sites subject to the same attack, it appears that the blocks injected into the sites are very similar.

The first time I ran across this, I found that a new user had been generated in wordpress, and that each of the edits were attributed to that user. In this most recent case, this has not happened.

The other curious thing is that in this round, the edits seem to have circumvented the revisions system.

As you can tell, the html inserted is not rendered on the page, but is clearly visible to google.

Let me know if anyone has any ideas.

* Footnotes

[fn:1]
[blog title=”From <div style=”position:absolute; left:-3535px;
top:-3231px;”>Takes product <a
href=”https://www.eewidget.com/loa/north-pharmacy-canada-lasix.html”>https://www.eewidget.com/loa/north-pharmacy-canada-lasix.html
of sides daily cured golfer <a
href=”https://secondnaturearomatics.com/xenical-cheap/”>xenical
cheap impressed told. Doesn’t it, <a
href=”https://www.theonlinehelpsite.com/north-american-pharmacy.html”>https://www.theonlinehelpsite.com/north-american-pharmacy.html
convinced redhead edge <a
href=”https://www.eewidget.com/loa/predizone-without-a-prescribtion.html”>https://www.eewidget.com/loa/predizone-without-a-prescribtion.html
treatment of t <a
href=”https://wildingfoundation.com/order-cialis-online-canada”>order
cialis online canada Anyways will: ever powder, <a
href=”https://www.streetwarsonline.com/dav/combo-packs-viagra-and-cialis.php”>https://www.streetwarsonline.com/dav/combo-packs-viagra-and-cialis.php
while would arrived more <a
href=”https://www.bakersfieldobgyn.com/best-legal-online-site-to-buy-viagra”>https://www.bakersfieldobgyn.com/best-legal-online-site-to-buy-viagra
brushes brushes. It’s bounds <a
href=”https://secondnaturearomatics.com/buy-novadex/”>https://secondnaturearomatics.com/buy-novadex/
give it not… Blemishes – know <a
href=”https://www.qxccommunications.com/cheap-propecia.php”>cheap
propecia it her WalMart big <a
href=”https://www.qxccommunications.com/varfendil-overseas.php”>varfendil
overseas deeply for products <a
href=”https://wildingfoundation.com/xenical-shipper”>https://wildingfoundation.com/xenical-shipper
known have Gel <a
href=”https://www.streetwarsonline.com/dav/generic-propecia-in-united-states.php”>generic
propecia in united states ago? With on <a
href=”https://secondnaturearomatics.com/do-some-aftermarket-viagras-work/”>inhouse
pharmacy biz skin on this cracks <a
href=”https://www.bakersfieldobgyn.com/non-prescription-canadian-viagra”>non
prescription canadian viagra injectables hair changed fairly <a
href=”https://www.bakersfieldobgyn.com/sildenafil-citrate-pfizer”>https://www.bakersfieldobgyn.com/sildenafil-citrate-pfizer
a not this them look <a
href=”https://wildingfoundation.com/alldaychemist-drugs”>mycanadian
pharmacy online trays in it watered <a
href=”https://www.theonlinehelpsite.com/baclofen-from-canda.html”>https://www.theonlinehelpsite.com/baclofen-from-canda.html
pregnant hours these and <a rel=”nofollow”
href=”https://www.eewidget.com/loa/cialis-online-canada-fast-delivery.html”>https://www.eewidget.com/loa/cialis-online-canada-fast-delivery.html
the Hilton’s bottle the crispy <a
href=”https://www.streetwarsonline.com/dav/buy-crestor-without-prescription-cheap.php”>order
clomid fast shipping anyone, elasticity new.</div> Our Blog”
category=”category-slug” item=”6″]