客户WordPress站点出现无作者无分类垃圾帖，如何排查？

Alright, let's dig into troubleshooting those weird spam posts showing up on your WordPress site—no author, no category, and you have no clue how they're getting published. Since only two admins have post permissions and you're running a pretty minimal setup (Storefront child theme + WooCommerce + WooCommerce Role Based Price), here's where to start:

• Double-check your WordPress user list: Scan for any hidden admin accounts you don't recognize. Attackers sometimes create new admins with subtle usernames that blend in with your existing accounts.
• Review login activity: Use WordPress's built-in site health logs (or enable a lightweight security plugin temporarily) to spot login attempts from unfamiliar IPs, or odd login times/locations from your two admins that they don't recall.
• Force password resets: Even if nothing looks off, reset both admin accounts with strong, unique passwords that aren't reused anywhere else. It's a quick way to rule out credential leaks.

• Check plugin versions: Confirm you're running the latest versions of WooCommerce and WooCommerce Role Based Price. Outdated plugins are the #1 attack vector for WordPress sites—look up recent vulnerability reports for both tools, especially role-based access plugins which sometimes have permission-escalation flaws.
• Test plugin disablement: Temporarily disable one plugin at a time and monitor if new spam posts stop. If they halt when a specific plugin is off, that's your culprit (either a vulnerability or a conflict opening a loophole).
• Inspect plugin files for tampering: Use your hosting file manager or FTP to check file timestamps in /wp-content/plugins/woocommerce/ and /wp-content/plugins/woocommerce-role-based-price/. If any files have recent, unexplained edits, attackers may have injected backdoors.

• Scan your child theme: Go through your Storefront child theme's functions.php and custom templates. Look for suspicious code snippets—like auto-post creation functions or code that bypasses WordPress permission checks. Child themes can get compromised if downloaded from untrusted sources or if an attacker gained edit access.
• Check core WordPress files: Use the Site Health tool (under Tools > Site Health) to verify no core files have been modified. If any are flagged, re-install the latest WordPress version to overwrite tampered files (this won't touch your content, themes, or plugins).

• Check XML-RPC abuse: The xmlrpc.php file is a common target for automated attacks. Review your server access logs for repeated requests to this file. If you don't use XML-RPC (e.g., for mobile apps), disable it temporarily to see if posts stop.
• Audit REST API access: Test if unauthenticated users can access the /wp-json/wp/v2/posts endpoint (visit it in an incognito window). If you can view or create posts without logging in, your REST API permissions are misconfigured.
• Check database inserts: Look at your wp_posts table (prefix may vary) in the database. Note the post_date_gmt and metadata of spam posts—attackers sometimes directly insert posts into the database instead of using WordPress's normal APIs, which would leave no author trail.

• Review access logs: Check your hosting provider's server logs for unusual requests—like hits to wp-admin/post-new.php from unknown IPs, or API requests with strange parameters that hint at exploit attempts.
• Scan for backdoors: Look for suspicious files in /wp-content/uploads/ (like unknown PHP files) or hidden dot-files in your root directory. Attackers often leave backdoors to regain access even after you fix the initial issue.

Once you narrow down the cause, you can take targeted action—whether it's updating a vulnerable plugin, removing a backdoor, or tightening API restrictions.

内容的提问来源于stack exchange，提问作者Gaspar