grossiro

Wordfence has found the malware https://203koko.eu/hjnfh/ipframe2.php in the W3T cache.
I don’t have the FancyBox for WordPress plugin installed but was hacked one month ago via Revslider plugin.
I have installed the new version of the Revslider plugin and regenerated wp-config salts and updadated admin passwords.
Unfortunately I found from time to time (checking WP-users table) that new admin users are created.
I was able to delete the malicious user via wordfence and block it thanks to CLEF plugin but I don’t know how they are able to create a new user.
It looks to me that they were able to add the malware through a backdoor rather than an obsolete plugin.
Gennady mentioned that they could have added arbitrary code execution in the admin panel. How I can check if this was the case?
Thanks for your help

Hi @rdellconsulting.
Thanks for your reply.
However the solution described in the post seems to applicable for 6 featured pages in two rows (same column width) while I am looking for 4 columns (adapting column width – using class span3 instead of span4) in one row.
Basically it seems that to achieve this I have to use a modified version of class-content-featured_pages.php but I don’t know how to do it with a child theme.
Any help would be much appreciated.