Title: WP_Term_Query->get_terms – SQL Error – Hacked? Last modified: May 5, 2020 --- # WP_Term_Query->get_terms – SQL Error – Hacked? * [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/) * I posted this in the WooCommerce plugin forum ( [https://wordpress.org/support/topic/product-categories-stopped-displaying-sql-error-hacked/](https://wordpress.org/support/topic/product-categories-stopped-displaying-sql-error-hacked/)– since this is how I first noticed the issue), but since I had to edit core WordPress code, I figured I would post it here as well to see if anyone had any suggestions or ideas: * I have no idea what happened, but something changed since yesterday that is wreaking havoc on our WordPress site. I don’t know how, but I suspect that someone hacked or exploited something, as I noticed there were 4 new categories that had been added to the taxonomy terms table with names like ‘casino’ and ‘investing’. Anyways, I looked through the server logs, and I couldn’t see anything out of the ordinary. However, I did see the below SQL error show up starting at 10:37 AM UTC this morning. I looked around this time frame at the logs to see how this change came about, but I have no idea. * Anyways here are some of the errors I am seeing: * ``` [05-May-2020 10:38:42 UTC] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') LIMIT 1' at line 1 for query SELECT t.*, tt.* FROM wpme_terms AS t INNER JOIN wpme_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy IN ('category') AND t.name IN ('investing,best') AND t.term_id NOT IN() LIMIT 1 made by require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), do_action('init'), WP_Hook->do_action, WP_Hook->apply_filters, dolly_plugin->wp_init, get_cat_ID, get_term_by, get_terms, WP_Term_Query->query, WP_Term_Query->get_terms [05-May-2020 10:38:42 UTC] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') ORDER BY t.name ASC' at line 1 for query SELECT t.*, tt.* FROM wpme_terms AS t INNER JOIN wpme_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy IN ('category') AND t.name IN ('investing,best') AND tt.parent = '0' AND t.term_id NOT IN() ORDER BY t.name ASC made by require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), do_action('init'), WP_Hook->do_action, WP_Hook->apply_filters, dolly_plugin->wp_init, wp_insert_term, get_terms, WP_Term_Query->query, WP_Term_Query->get_terms [05-May-2020 10:38:42 UTC] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') ORDER BY t.term_id ASC' at line 1 for query SELECT t.term_id, tt.parent, tt.count, tt.taxonomy FROM wpme_terms AS t INNER JOIN wpme_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy IN ('category') AND t.term_id NOT IN() ORDER BY t.term_id ASC made by require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), do_action('init'), WP_Hook->do_action, WP_Hook->apply_filters, dolly_plugin->wp_init, wp_insert_term, clean_term_cache, clean_taxonomy_cache, _get_term_hierarchy, get_terms, WP_Term_Query->query, WP_Term_Query->get_terms [05-May-2020 10:38:42 UTC] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')' at line 1 for query SELECT t.*, tt.* FROM wpme_terms AS t INNER JOIN wpme_term_taxonomy AS tt ON t.term_id = tt.term_id INNER JOIN wpme_term_relationships AS tr ON tr.term_taxonomy_id = tt.term_taxonomy_id WHERE tt.taxonomy IN ('category') AND tr.object_id IN (32158) AND t.term_id NOT IN() made by require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), do_action('init'), WP_Hook->do_action, WP_Hook->apply_filters, dolly_plugin->wp_init, wp_insert_post, wp_set_post_categories, wp_set_post_terms, wp_set_object_terms, wp_get_object_terms, get_terms, WP_Term_Query->query, WP_Term_Query->get_terms [05-May-2020 10:38:42 UTC] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') ORDER BY t.name ASC' at line 1 for query SELECT t.*, tt.* FROM wpme_terms AS t INNER JOIN wpme_term_taxonomy AS tt ON t.term_id = tt.term_id INNER JOIN wpme_term_relationships AS tr ON tr.term_taxonomy_id = tt.term_taxonomy_id WHERE tt.taxonomy IN ('category') AND tr.object_id IN (32158) AND t.term_id NOT IN() ORDER BY t.name ASC made by require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), do_action('init'), WP_Hook->do_action, WP_Hook->apply_filters, dolly_plugin->wp_init, wp_insert_post, wp_transition_post_status, do_action('transition_post_status'), WP_Hook->do_action, WP_Hook->apply_filters, _update_term_count_on_transition_post_status, wp_get_object_terms, get_terms, WP_Term_Query->query, WP_Term_Query->get_terms [05-May-2020 10:38:42 UTC] WordPress database error You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ') ORDER BY t.name ASC' at line 1 for query SELECT t.*, tt.* FROM wpme_terms AS t INNER JOIN wpme_term_taxonomy AS tt ON t.term_id = tt.term_id INNER JOIN wpme_term_relationships AS tr ON tr.term_taxonomy_id = tt.term_taxonomy_id WHERE tt.taxonomy IN ('post_tag') AND tr.object_id IN (32158) AND t.term_id NOT IN() ORDER BY t.name ASC made by require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), do_action('init'), WP_Hook->do_action, WP_Hook->apply_filters, dolly_plugin->wp_init, wp_insert_post, wp_transition_post_status, do_action('transition_post_status'), WP_Hook->do_action, WP_Hook->apply_filters, _update_term_count_on_transition_post_status, wp_get_object_terms, get_terms, WP_Term_Query->query, WP_Term_Query->get_terms ``` * Anything that loaded categories or taxonomy appeared to be broken. I fixed this problem by editing CORE WordPress code, which I don’t think is the right thing to do, but it fixed our issues (for now). * In wp-includes/class-wp-term-query.php after line 676 of: * `$this->request = "{$this->sql_clauses['select']} {$this->sql_clauses['from']}{ $where} {$this->sql_clauses['orderby']} {$this->sql_clauses['limits']}";` * I added this line: * `$this->request = str_replace('AND t.term_id NOT IN()', '', $this->request);` * For some reason, a `NOT IN()` empty clause is being added to our SQL queries ( which is invalid SQL), and I have no idea why. Anyone know what might be going on? As far as I know, no WordPress plugins or WordPress itself updated last night. I’m running WordPress 5.4.1 with the latest version of WooCommerce. * Below are my untested WooCommerce plugins (for the version I’m running): * Disable WooCommerce Admin by – 1.0 – Not tested with the active version of WooCommerce Hide WooCommerce Categories On Shop Page by Matix Web Designers – 1.1.0 – Not tested with the active version of WooCommerce Delivery Date & Time for WooCommerce by CodeRockz – 1.2.6 – Not tested with the active version of WooCommerce WooCommerce Schedule Stock Manager by Geek Web Solution – 1.0 – Not tested with the active version of WooCommerce WooCommerce PDF Invoices by Bas Elbers – 3.0.11 – Not tested with the active version of WooCommerce WooCommerce SecureSubmit Gateway by SecureSubmit – 1.12.1 – Not tested with the active version of WooCommerce * However, as I said, everything was working fine, and I’ve been using the same plugins listed above for months. Anyone know what might be going on? Can anyone help? Viewing 14 replies - 1 through 14 (of 14 total) * Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/) * (@sterndata) * Volunteer Forum Moderator * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12786310) * Never Ever Edit Core. * From DASHBOARD->UPDATES click the button to reinstall the current version of WordPress. That should eliminate your edits. * Install WordFence and do a complete scan of your site. * Once that’s done, let’s reevaluate. * Thread Starter [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12786500) * My change in the core code won’t break anything since it only replaces invalid SQL if it’s there (I’m a web developer myself, so I know what I changed is fine), but yeah, I’ve been trying your suggestions. WordFence didn’t find anything extraordinary except for some old plugins I’m not using that I’ve since deleted, and I found some malicious files these casino people uploaded. Attached here: * _[redacted – please do not distribute hacks]_ * Wish I could figure out what code was exploited or used to get these files into the uploads folder… * Also, despite cleaning things up through WordFence, my SQL queries are still wrong: * `SELECT DISTINCT t.*, tt.* FROM wpme_terms AS t LEFT JOIN wpme_termmeta ON ( t.term_id = wpme_termmeta.term_id AND wpme_termmeta.meta_key='order') INNER JOIN wpme_term_taxonomy AS tt ON t.term_id = tt.term_id WHERE tt.taxonomy IN ('product_cat') AND ( ( wpme_termmeta.meta_key = 'order' OR wpme_termmeta.meta_key IS NULL ) ) AND t.term_id NOT IN() ORDER BY wpme_termmeta.meta_value+0 ASC, t.name ASC` * **AND t.term_id NOT IN()** is the problem causing SQL errors. * I downloaded the zip of WordPress 5.4.1, ran BeyondCompare against its class- wp-term-query.php vs my modified version (that I modified), and my change was the only difference. Thus, I don’t think the exploit touched any of the WordPress core files, but something happened to screw up the SQL queries. - This reply was modified 6 years, 1 month ago by [own3mall](https://wordpress.org/support/users/own3mall/). - This reply was modified 6 years, 1 month ago by [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/). * Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/) * (@sterndata) * Volunteer Forum Moderator * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12786559) * Get a fresh cup of coffee, take a deep breath and carefully follow [this guide](https://wordpress.org/support/article/faq-my-site-was-hacked/). When you’re done, you may want to implement some (if not all) of [the recommended security measures](https://wordpress.org/support/article/hardening-wordpress/). * If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple. * Thread Starter [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12786840) * That’s not really all that helpful. I’ve done all of the above, and I still can’t figure out why the SQL queries are wrong. Without my fix, the site is completely broken, and I’ve cleaned out as much as I can, and WordFence finds no issues other than my modified file (which I modified myself to fix the SQL issues)… * Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/) * (@jdembowski) * Forum Moderator and Brute Squad * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12786886) * Side note: I archived the original topic. Please don’t create duplicate topics. * > and I found some malicious files these casino people uploaded * Which is the best indicator of compromise there is. Steve’s right; it’s not fun but you really need to delouse your site. Those links, while cumbersome, will get you on track to sort it out. But it is a lot of reading and work. There is no magic fix here. * _*Drinks coffee*_ * I’m not saying you expect a silver bullet solution, I’m just pointing out you’ve unfortunately got a lot of work ahead of you. That site needs to be deloused. * Moderator [Samuel Wood (Otto)](https://wordpress.org/support/users/otto42/) * (@otto42) * WordPress.org Admin * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12786920) * Given that you had some spam tags added, then a NOT IN being weird indicates that some other code somewhere on your site might have been attempting to hide them from the interface, but that code is broken. Which really just comes back down to the fact that you need to go through the files on your site and see where that code is. * Thread Starter [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787011) * I already have… * `grep -r "NOT IN" .` * in the httpdocs directory * Doesn’t show me much other than the base core code! * Thread Starter [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787448) * OK, more digging, and someone is able to create posts without being logged in, create categories without being logged in, and more. How is this possible? I also ran this command to find recently modified files since these issues occurred, and I’m not finding anything! * ``` find $1 -type f -exec stat --format '%Y :%y %n' "{}" \; | sort -nr | cut -d: -f2- | head ``` * They’re sending a POST request to the main index page to accomplish this. Using tcpdump to capture the packets, but how are their posts being hidden from the posts screen? - This reply was modified 6 years, 1 month ago by [own3mall](https://wordpress.org/support/users/own3mall/). * Thread Starter [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787465) * The broken IN SQL is coming from these lines of code (in wp-includes/class-wp- term-query.php): * ``` $clauses = apply_filters( 'terms_clauses', compact( 'fields', 'join', 'where', 'distinct', 'orderby', 'order', 'limits' ), $taxonomies, $args ); $fields = isset( $clauses['fields'] ) ? $clauses['fields'] : ''; $join = isset( $clauses['join'] ) ? $clauses['join'] : ''; $where = isset( $clauses['where'] ) ? $clauses['where'] : ''; $distinct = isset( $clauses['distinct'] ) ? $clauses['distinct'] : ''; $orderby = isset( $clauses['orderby'] ) ? $clauses['orderby'] : ''; $order = isset( $clauses['order'] ) ? $clauses['order'] : ''; $limits = isset( $clauses['limits'] ) ? $clauses['limits'] : ''; ``` * So, how does the $clauses variable get populated? Would that be pulling something from the database? * Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/) * (@sterndata) * Volunteer Forum Moderator * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787474) * This is getting dangerously close to a “how to hack WordPress” topic now. * Follow the clean-up link from above. Basically, remove all .htaccess, .php and. js files (wordpress, theme, plugins) and replace them from valid source repos. Preserve only wp-config.php (but check it for malware). * Thread Starter [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787563) * I’d rather pinpoint the problem and fix it while giving you guys information on how they’re hacking this if possible. * Thread Starter [own3mall](https://wordpress.org/support/users/own3mall/) * (@own3mall) * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787591) * Again, WordFence isn’t finding any modified files. So, reinstalling everything from “valid” source repos would do me no good. * Moderator [Steven Stern (sterndata)](https://wordpress.org/support/users/sterndata/) * (@sterndata) * Volunteer Forum Moderator * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787599) * Please do not post any more info about how your site has been hacked publicly. If you find a vulnerability, report it properly. * [https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/](https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/) [https://developer.wordpress.org/plugins/wordpress-org/plugin-security/reporting-plugin-security-issues/](https://developer.wordpress.org/plugins/wordpress-org/plugin-security/reporting-plugin-security-issues/) * Moderator [Samuel Wood (Otto)](https://wordpress.org/support/users/otto42/) * (@otto42) * WordPress.org Admin * [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787788) * The main term query cannot generate empty NOT IN lines. The relevant code looks like this: * ``` if ( ! empty( $exclusions ) ) { $exclusions = 't.term_id NOT IN (' . implode( ',', array_map( 'intval', $exclusions ) ) . ')'; } else { $exclusions = ''; } ``` * As you can see, the NOT IN can only be generated if the list of things to exclude isn’t empty. Even if it was an empty array, or null, or what have you, then it either wouldn’t be there, or it would be intval’d to the number zero. * And if they can create posts, then they still have malware running on your site. The bottom line is that you may not be capable of finding it, so restore from a backup or hire somebody to fix it for you, or something else. * You have been hacked. Further information about it isn’t really relevant here because the truth is that no code in WordPress is facilitating the hack, they’re not doing it through WordPress, they are doing it through other malicious code that they have on your site and which you have not discovered. Until you clean your site, the hack will remain there. Viewing 14 replies - 1 through 14 (of 14 total) The topic ‘WP_Term_Query->get_terms – SQL Error – Hacked?’ is closed to new replies. * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) * 14 replies * 4 participants * Last reply from: [Samuel Wood (Otto)](https://wordpress.org/support/users/otto42/) * Last activity: [6 years, 1 month ago](https://wordpress.org/support/topic/wp_term_query-get_terms-sql-error-hacked/#post-12787788) * Status: not resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics