simplix

Hallo,

De plug-in werkt na een aanpassing weer naar behoren.
Geen vedere actie vereist, Dank!

• This reply was modified 3 years, 10 months ago by simplix.

In our case it was the outdated AAM plugin we run on a lot of sites. Updating those fixed the problem.

if you got any outdated plugins. Update those right after you get back in the wp-admin.

then change your database password and update the wp-config. After that change the admin password in wordpress.

Hey @lfbender

Maybe there’s a second script injected. you should check if there’s a different script as the first one in the wp_posts or wp_options.

Also check if the wp_options table -> siteurl and home is set correctly. if that’s fixed try to go to /wp-admin.

If that still doesn’t work, clear your cache or try an incognito tab / different browser.

Backup ur DB before you do this.

update query we used:

UPDATE wp_posts SET post_content = REPLACE(post_content,”PUT_THE_SCRIPT_HERE”,””);
UPDATE wp_posts SET guid = REPLACE(guid,”PUT_THE_SCRIPT_HERE”,””);
UPDATE wp_postmeta SET meta_value = REPLACE(meta_value,”PUT_THE_SCRIPT_HERE”,””);

UPDATE wp_options SET option_value = REPLACE(option_value,”PUT_THE_LINK_HERE”,”PUT_HOMEPAGE_LINK_HERE”) WHERE option_name = “siteurl”;
UPDATE wp_options SET option_value = REPLACE(option_value,”PUT_THE_LINK_HERE”,”PUT_HOMEPAGE_LINK_HERE”) WHERE option_name = “home”;

did you update the wp_options aswell? since they change the home/wordpress url with the hack.

Then after that renew your DB password and update plugins

• This reply was modified 5 years, 2 months ago by simplix.

Hello,

We also had problems with our sites being hacked.
To solve the problem we wrote a query to remove te scripts.
Make sure before you excecute the query you have a backup made from your database.

UPDATE wp_posts SET post_content = REPLACE(post_content,”PUT_THE_SCRIPT_HERE”,””);
UPDATE wp_posts SET guid = REPLACE(guid,”PUT_THE_SCRIPT_HERE”,””);
UPDATE wp_postmeta SET meta_value = REPLACE(meta_value,”PUT_THE_SCRIPT_HERE”,””);

UPDATE wp_options SET option_value = REPLACE(option_value,”PUT_THE_LINK_HERE”,”PUT_HOMEPAGE_LINK_HERE”) WHERE option_name = “siteurl”;
UPDATE wp_options SET option_value = REPLACE(option_value,”PUT_THE_LINK_HERE”,”PUT_HOMEPAGE_LINK_HERE”) WHERE option_name = “home”;

Make sure you use your own Prefix and copy the script from one of the wp_posts.