admin管理员组

文章数量:1122832

I do have a problem on my WordPress site. In the frontend there is a spam post (not a comment, a post) visible to everybody. I don't know where it comes from and all malware scans were negative so far. However, in order to solve this problem I will need to delete this post. But it can't be seen in the backend.

As you can see on the given screenshot the posts area shows "all posts" with the number of 58. However, when going through them via the pagination there are only 57. As I can't find the spam post via normal search methods I assume the spam post has somehow been hidden. There are no posts in the trash or whatsoever. I also checked pages, categories, tags, etc. but nothing.

Is there a way to remove it eventually?

I do have a problem on my WordPress site. In the frontend there is a spam post (not a comment, a post) visible to everybody. I don't know where it comes from and all malware scans were negative so far. However, in order to solve this problem I will need to delete this post. But it can't be seen in the backend.

As you can see on the given screenshot the posts area shows "all posts" with the number of 58. However, when going through them via the pagination there are only 57. As I can't find the spam post via normal search methods I assume the spam post has somehow been hidden. There are no posts in the trash or whatsoever. I also checked pages, categories, tags, etc. but nothing.

Is there a way to remove it eventually?

  • posts
  • spam
  • hacked
Share Improve this question asked May 14, 2020 at 7:19 UserSoUndSoUserSoUndSo 1253 bronze badges
Add a comment  | 

2 Answers 2

Reset to default 1

I'd try

  • open the spam post in your browser and find the post ID. This will be in a rel='shortlink' tag in the HTML header:

    <link rel='shortlink' href='https://example.com/?p=123' />

    or as a class page-id-123 or similar on the body tag:

    <body class="page-template-default page page-id-123 logged-in admin-bar
             no-customize-support">

  • edit that ID into your normal edit post URL, e.g. 

    https://example.com/wp-admin/post.php?post=123&action=edit

You should then be able to edit or delete the spam post from there. If that doesn't work, look for that ID in the wp_posts table in your database and see if you work out why it's not showing up, or just delete it from wp_posts and wp_postmeta there.

Or if you want to see why the post counts differ, I'd compare the SQL queries WordPress is using to count the posts and list them, e.g. using the Query Monitor plugin.

I've discovered that Wordpress will NOT show the posts in the Posts List (in wp-admin) if the post's user does not exist.

For whatever reason, my WP database does not have a foreign key constraint forcing a valid wp_user for every wp_post::post_author. I'm not sure if this is by design, or a hacker dropped the key constraint.

Regardless, if you do the following SQL command, you'll see a list of all the posts with a missing author:

select id,post_author, post_status, post_title from wp_posts where post_author not in (select id from wp_users);

Then I created a new "SirSpamALot" user and reassigned all the posts to that user.

update wp_posts set post_author=THE_NEW_USER_ID where post_author=INVALID_USER_ID;

And now I can see in the post list, and use the normal WP buttons to delete the posts.

Pretty dumb that wp-admin won't list the posts, but is quite happy to server the posts to visitors.

本文标签： Invisible spam post in backend

版权声明：本文标题：Invisible spam post in backend 内容由网友自发贡献，该文观点仅代表作者本人， 转载请联系作者并注明出处：http://www.betaflare.com/web/1736282963a1926812.html， 本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容，一经查实，本站将立刻删除。