Invisible spam post in backend

Question

Invisible spam post in backend

UserSoUndSo

2022年5月19日 06:17

I do have a problem on my WordPress site. In the frontend there is a spam post (not a comment, a post) visible to everybody. I don't know where it comes from and all malware scans were negative so far. However, in order to solve this problem I will need to delete this post. But it can't be seen in the backend.

As you can see on the given screenshot the posts area shows "all posts" with the number of 58. However, when going through them via the pagination there are only 57. As I can't find the spam post via normal search methods I assume the spam post has somehow been hidden. There are no posts in the trash or whatsoever. I also checked pages, categories, tags, etc. but nothing.

Is there a way to remove it eventually?

Topic hacked spam posts Wordpress

Category Web

user92979 · Accepted Answer · 2022年5月19日 06:17

I've discovered that Wordpress will NOT show the posts in the Posts List (in wp-admin) if the post's user does not exist.

For whatever reason, my WP database does not have a foreign key constraint forcing a valid wp_user for every wp_post::post_author. I'm not sure if this is by design, or a hacker dropped the key constraint.

Regardless, if you do the following SQL command, you'll see a list of all the posts with a missing author:

select id,post_author, post_status, post_title from wp_posts where post_author not in (select id from wp_users);

Then I created a new "SirSpamALot" user and reassigned all the posts to that user.

update wp_posts set post_author=THE_NEW_USER_ID where post_author=INVALID_USER_ID;

And now I can see in the post list, and use the normal WP buttons to delete the posts.

Pretty dumb that wp-admin won't list the posts, but is quite happy to server the posts to visitors.

Rup · Accepted Answer · 2020年5月14日 08:35

I'd try

open the spam post in your browser and find the post ID. This will be in a rel='shortlink' tag in the HTML header:

<link rel='shortlink' href='https://example.com/?p=123' />

or as a class page-id-123 or similar on the body tag:

<body class="page-template-default page page-id-123 logged-in admin-bar
             no-customize-support">

edit that ID into your normal edit post URL, e.g.

https://example.com/wp-admin/post.php?post=123&action=edit

You should then be able to edit or delete the spam post from there. If that doesn't work, look for that ID in the wp_posts table in your database and see if you work out why it's not showing up, or just delete it from wp_posts and wp_postmeta there.

Or if you want to see why the post counts differ, I'd compare the SQL queries WordPress is using to count the posts and list them, e.g. using the Query Monitor plugin.

Invisible spam post in backend

About