WP Pro – Design, Development and Professional WordPress Hosting for Serious Bloggers - Just another WordPress weblog


Site Hacked: Site Name and Post Titles Changed via Database (Possible Fix)


Fixing the problem:

  1. Download a copy of your database either by using a plugin (such as the one mentioned at the beginning of the post) or via the phpMyAdmin (as described here).
  2. Once you get a copy of the DB on your hard drive, open it using Notepad. Then search (Ctrl+f) for “rss_f541b3abd05e7962fcab37737f40fad8″
  3. This was determined by Chris as the starting point to look for issues, if your DB has this string then your DB is hacked. Look through the DB to find gibberish that is usually preceded by mentions of “Events Calendar” which is a built in WP plugin that is serving as the point of injection of the exploit.

You will now have two options to fix this.

Option 1

  1. If you make frequent backups of your DB
  2. Open all recent copies of your DB and search for “rss_f541b3abd05e7962fcab37737f40fad8″, select the one that does not have this string.
  3. Note the date/time the clean DB was downloaded and also note posts/comments that were made since the DB download. If the number of posts/comments are excessive, then use method 2 (explained below).
  4. If not, simply overwrite the corrupt DB by importing the clean file using phpMyAdmin. If using phpMyAdmin is not your thing, use method 2 will not make much sense either, the only reason for method 2 is to help the frequent poster/commenter from not loosing their work.

2 Responses to “Site Hacked: Site Name and Post Titles Changed via Database (Possible Fix)”

  1. I had no idea that people could do this!! Jeez, it’s a jungle out there. I will definitely be using that backup plugin now – thanks!

  2. I agree with this post as backups are certainly important. I’ve come across a situation similar to this that put our business back a whole week due to not properly backing up our servers. Take advantage of any automated tools – they’re worth it..even if you need a quick fix.


Leave a Response

Some Useful Info

Use SimpleCode while including codes.

The links from all comments have the no-follow tag to prevent spammers from gaming their way up into SERP. So please keep the comments clean, try not to use keywords as "Names" or post unnecessary links in the comments. Thank you for cooperating.



Copyright © WP Pro – Design, Development and Professional WordPress Hosting for Serious Bloggers - CSS | XHTML | Login | Return to Top ↑