We’ve just had an issue with some spam showing up on the site. Not the run-of-the-mill comment-based sort. It was hidden in a block of html enclosed in a
<u style display: none></u> tag. Weirdly, and this is the disturbing bit, it appeared as a block of HTML appended to our index.php file, which really shouldn’t happen at all. The result was that WordPress would render CT pages and then this bit of spam text would be right at the bottom of the html, outside the
body tags, etc, as the index.php file closed out.
The permissions on the index.php file are right and our WP installation is up to date. There doesn’t seem to be anything else amiss, and apart from it appearing in a very strange place it seems like automated rather than handcrafted spam. (Another odd thing was that some of the spam links pointed to some personal pages hosted by washington.edu, but I didn’t follow the links.) Unfortunately I don’t know how long the spam has been there. What happened to us is approximately the same as what happened to this guy on the WP support forum, but there wasn’t any helpful followup from that thread. Has anyone encountered this issue before?