Title: Eval base64 – SOLUTION
Last modified: August 20, 2016

---

# Eval base64 – SOLUTION

 *  [craziness](https://wordpress.org/support/users/craziness/)
 * (@craziness)
 * [14 years, 4 months ago](https://wordpress.org/support/topic/eval-base64-solution/)
 * …and EASY solution, at that…
 * I suffered severe eval base injections into all of my sites the past week or 
   two. I have also been hacked, had the dancing little Mexican visiting my site
   hehe…sure it caused for a great laugh but also panic stations as I have clients
   that pay.
 * My very awesome server-people advised me that I had been attacked and that it
   came from my plugins – they could not say which of course…
 * Yesterday, after many hours trying to decode especially the functions.php pages–
   I decided to see if there is a “eval base64” detector plugin for WordPress. I
   found the **[Threat Scan Plugin](http://downloads.wordpress.org/plugin/threat-scan-plugin.zip)**,
   installed it. It installs under the “settings” option in your admin panel. I 
   was amazed – it pointed out exactly which plugins was the “leak”. It does nothing
   else but that, so you don’t have to worry that it breaks code at all. You have
   to uninstall (delete) the plugins causing that, yourself.
 * Do yourselves a favour and install this and delete the plugins it points out –
   MY WordPress sites was immediately saved, yours will be too! You MAY have to 
   replace your functions.php file with the healthy one though, but you won’t be
   sorry.
 * Should you have tried to fix your site and broken it, perhaps your server-people
   would have a backup to reinstall – even if it is affected (which it should then
   be, if the plugin is in that backup). Don’t panic, just do the above and relax.
 * It sure worked for me.
 * Happy blogging!
 * PS:
    The Newsletter plugin and Mail plugin was two that I had to remove…can’t
   remember which other. Be very careful and run the **[Threat Scan Plugin](http://downloads.wordpress.org/plugin/threat-scan-plugin.zip)**
   regularly, as perhaps with the updates of the plugins they sneak in their little
   eval base64 codes.

Viewing 3 replies - 1 through 3 (of 3 total)

 *  [Keith P. Graham](https://wordpress.org/support/users/kpgraham/)
 * (@kpgraham)
 * [14 years, 4 months ago](https://wordpress.org/support/topic/eval-base64-solution/#post-2580697)
 * This is exactly why I created it. It is brute force and very dumb. It only took
   a few minutes to write, but it works. I have repaired many client sites using
   it.
 * Thanks for the endorsement.
 * Keith
 *  Thread Starter [craziness](https://wordpress.org/support/users/craziness/)
 * (@craziness)
 * [14 years, 4 months ago](https://wordpress.org/support/topic/eval-base64-solution/#post-2580698)
 * I must tell you I fixed my site…after struggling the WHOLE day…in 5 minutes. 
   What a relief..! THANK YOU!
 *  [mgk](https://wordpress.org/support/users/mgk/)
 * (@mgk)
 * [14 years, 3 months ago](https://wordpress.org/support/topic/eval-base64-solution/#post-2580828)
 * I was using wingrep on the server (I have remote desktop) and this found some
   stuff that it had missed. Simple but effective!

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Eval base64 – SOLUTION’ is closed to new replies.

 * 3 replies
 * 3 participants
 * Last reply from: [mgk](https://wordpress.org/support/users/mgk/)
 * Last activity: [14 years, 3 months ago](https://wordpress.org/support/topic/eval-base64-solution/#post-2580828)
 * Status: not a support question

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics