Wordpress spam hack - unauthorized include file class-mail.php

So we got hacked. Thanks to our visitors, who noticed another problem and looked under the hood, the hack was identified pretty quickly.

Someone managed to inject a file into our includes directory that inserted a lot of scarfy links to allebia.something. Simply renaming or removing the file eliminates the links. Other files that were modified (and had to be restored from backup) were classes.php and default-filters.php.

Our Wordpress installation is a bit old but we’ll be upgrading later this week and installing some new plug-ins.