The presence of the functions.php file is essential for any theme to be recognized by WordPress and therefore gets executed during each page view. This makes it a good target for a malicious code.
2 How to detect the Apiword Infection?
3 What does the malware code in functions.php do?
5 How to Prevent your functions.php from being hacked?
In one of the instances, the culprit behind the injection of the infected code into functions.php is a malicious plugin called woocommerce-direct-download. This plugin contained a malicious script called woocp.php hosting some obfuscated PHP code which, on execution, injected the malicious code into all the functions.php files.
Infecting all WordPress websites on the server.
Worried about WordPress security? Drop us a message on the chat widget and we’d be happy to help you fix it.
How to detect the Apiword Infection?
It is essential to know that the malicious code is added to the top of every functions.php file which is found within the root directory of each installed theme. For example, if the WordPress site has a theme called “MyTheme”, then the malicious code would be added to the wp-content/themes/MyTheme/functions.php file.
The file path known to contain the malicious code is“@file_puts_contents($_SERVER[‘DOCUMENT_ROOT’].’/wp-includes/class.wp.php’,file_get_contents)”.
This code would essentially contain a signature in form of a variable by the name wp_cd_code. This can aid in identifying infected files.
Executing this would begin a recursive search for the signature string “wp_cd_code” through all .php files. The output would then present the file path and the line number containing the search string.
What does the malware code in functions.php do?
In a layman’s language, the code injector configures the malicious code for each site, injects into the PHP file which will run on each user request, which is reported back to the attacker. This code checks for the variables action and password passed in the HTTP request. If the password matches the hard-coded hash (which is generated by the code injector) then the injected code executes an action based on the contents of the action variable.
The attacker can use the generated password to gain admin privileges without following the usual route of logging in. This provides the attacker with the privilege of certain actions like adding arbitrary content and modifying posts on the infected site. Also, check our article on PHP Code Execution in WordPress.
Check every functions.php file for the malicious code. The concerned code would be found within the first <? php ?> block in the PHP file, hence the necessity of removing this block entirely.
Immediately remove the code injector, in case it still exists. For example, in the case of the woocommerce-direct-download plugin, the code injector was contained in a file called woocp.php. Hence, it needs to be deleted.
Look out for the <wp_prefix>_datalist and <wp_prefix>_install_meta tables. Keep a note of its as this might help to find posts that have been modified. Thereafter, ensure to delete these tables.
Scan all posts for the signature variable “wp_cd_code” and remove this DIV for each affected post.
How to Prevent your functions.php from being hacked?
Monitor new files being created on the server – A Web Application Firewall (WAF) like Astra when deployed, essentially scours for any new/ deleted/modified files being created on the server and routinely scans for malware presence.
Avoid using nulled/pirated themes: It is advised to only rely on themes from authentic and official sources.
Installing all WordPress updates: WordPress regularly releases updates and plugins to mitigate for any revealed vulnerabilities. Astra’s WordPress Security ensures timely notifications of updates and plugins for your WordPress Site.
To know about the latest happenings in the WordPress community or get notified about the update release, subscribe to our blog on WordPress Security.