theme overwrites other theme's function.php

Those lines are actually copied into the functions.php files of other themes? That seems like very bad behavior to me.

Also the theme has lines like this in its functions.php:

eval(str_rot13('shapgvba purpx_urnqre(){vs(!(shapgvba_rkvfgf("purpx_shapgvbaf")&&shapgvba_rkvfgf("purpx_s_sbbgre"))){rpub(\'Guvf gurzr vf eryrnfrq haqre perngvir pbzzbaf yvprapr, nyy yvaxf va gur sbbgre fubhyq erznva vagnpg\');qvr;}}'));

That example is a Creative commons notice. Why you’d rot13 that I don’t know. Nonetheless, “Attempts at obfuscation” === “I don’t trust that theme”. That in itself is enough for me, but my distrust is justified by this (crudely un-rotted with a little code removed to get it under ten lines ?? ):

`… $l=\’Designed by <a href=”https://www.utahmatch.com”>Utah personals</a></div>…
<a href=”https://www.localhospitaljobs.com/hospital-jobs-in-miami-florida”>Miami Hospital Jobs</a>
<a href=”https://www.meetlocalbikers.com”>Biker Personals</a>
<a href=”https://www.certifiedpublicaccountants.com/”>Accountants</a&gt;\’…
echo \’This theme is sponsored, all links in the footer should remain intact\’;die;}}check_footer();’));`

Use it or not, your choice.

Thanks. Yes the lines quoted above are appended to all other themes functions.php. How can this happen?

I did not know about the removed lines, but i’ll compare the files with the original ones…

Do you think that the modified footer can cause issues like this line appending thing?

The code I found wouldn’t do it, but it isn’t that hard to do. WordPress itself has the ability to write files to the server, and edit them. That is how your image uploads work and how the built in code editor works, for example. Anything piggie-backed onto WordPress can do the same thing, subject to server file permission and other settings.

I haven’t found any code in that theme that will write files so for the sake of fairness, the claim that this theme is doing it is still unproven. I also can’t find any of the function names from your original post, nor can I find a block of eval’ed or rotn’ed code large enough to hold that much text– not even close. I think you may need to look elsewhere for the problem.

For this theme, the obfuscation is red flag enough for me though.

Issue fixed. The problem was with the following code:

https://pastebin.com/HbcDc8sd

I tred to register widgets in multisite environment the way i used to register them in standalone site. I think database operations caused the crash