chrisprouty

Here’s my workaround that I’m using on a client site until we can better understand the source of the hack.

I’ve noticed that the attack happens through both the header.php of the theme and through the WP file nav-menu.php. Same symptoms everyone is reporting in this thread. WordFence picks up on both files being infected.

Since the temporary fix is to replace the infected file with a clean file, I’ve included two lines of code in the index.php file at the root of the WordPress installation:

copy("/home3/user/public_html/nav-menu.php", "/home3/user/public_html/wp-includes/nav-menu.php");
copy("/home3/user/public_html/header.php", "/home3/user/public_html/wp-content/themes/themename/header.php");

I placed copies of the header.php and nav-menu.php files at the hosted root.

I put these near the beginning of the file, before anything else happens.

What these lines do is automatically copy clean versions of the files whenever someone visits the site, so if a file, like header.php gets infected, it is overwritten before it is called into the browser upon a site visit.

Simply put, I’m automating the process of overwriting infected files with clean ones and triggering that automation when someone visits the site.

If you do this, you’ll have to modify the code to fit your server’s directory structure.

Look, I know this is pounding in a nail with a sledgehammer. It’s a band-aid, not a panacea. It’s buying me the time to find the real problem. Yes, I know, copying files on page load is a lot of server work and a WordPress update will overwrite my changes. Bake a pie, eat a pie. It’s working of now and keeping people on site.

Brilliant, David. I agree.

I re-upped the WP core files through FTP and the problem sorted itself out.

Thanks for thinking this through with me. Marking as resolved.

That is correct. Fresh install of 4.1, not evan an upgrade from a previous build.

Hi David, Thanks…sorry for not including.

4.1/1.9.51

Twenty Fifteen and Twenty Fourteen produce the same exact results. Even in the Web Inspector.

Thank you again.

Further, I’ve installed using three different methods: the automated process, uploading a ZIP, and uploading the plugin directory. Same results.

This helped me immensely. Thank you.

Thank you very much!