Recently, we have accidentally discovered in our blog posts a new dangerous viral activity based on an advertising script that exploits the security leaks of WordPress platform. This type of attack could be also present in the tens of millions of online WordPress blogs.

The virus actions upon WordPress platform by inserting a .PHP file in the root of the installation directory and then it connects to the database. On a successful connection various blog posts are modified with long lists of spam links masked with CSS. (the visitors cannot see them, but the search engine robots index those links). As a consequence, you will have to manually check all of your posts and
remove the link after the .PHP file removal. The most simple solution
to check the affected posts is to create an xml file of RSS feeds from
all of your posts and view them in an RSS reader. The entire article is available at downloadtube.com/blog/.

    

Thanks for the information. Sounds like a pretty involved resolution but there may not be much else to do. Those affected may be able to use a mySQL client software like Navicat to script this out. It is also possible to dump the database and fix using UltraEdit with some fancy script work.

woww, thanks for the info.

Thankiossk Cool!

Thanks for information,i think this is great achevment.

that was really an informative and helpful post! thanks for sharing by the way!

Thanks for the info bochiman

how it inserts a php file in the root without FTP access????

thanks for the info.

thanks bro..... I use wordpress and you saved my life.... LOLZZZ