This is not the first time I’ve seen this – spammers somehow hack into WordPress template files and add in their junk, styling it inline so it’s not visible on your blog. Hidden junk mail, basically, in your theme. It happened to me over a year ago, but this particular incident was a refresher course as I found it in a client’s header file while upgrading and updating her theme. Please, please please – check your theme template files regularly. Particularly your header.php, those buggers like to get their links in there and set up negative margins before your content begins on the page.
Here are a couple of screenshots – click to enlarge. You can see the menu_rll is the div id used to enclose the spam. In this case, they hacked into both the header.php as well as the main index.php.
Found in the header.php template
Found in the index.php template
So folks, this might be news to you – but you might just find some spammy links in your template files. Go on and check, it only takes a minute. Look under presentation/theme editor and just scroll through your template files to make sure there’s nothing spammy going on with your website that you don’t know about. And also – if you’re not using the most current version of WordPress, It’s time to upgrade.. Eliminate any possible vulnerability.
UPDATE: Another WP user discovered massive amounts of spam in his template, it actually affected his Google ads – the ad content started getting “spammy” and he couldn’t figure out why. Check out his experience here.
Another update: I am also being told that when upgrading – it is HIGHLY advised to completely delete everything but the wp-config file and upload the fresh upgrade to ensure any files that were hacked are gone and avoid future vulnerabilities. For detailed and easy to follow upgrade instructions, see my post here.
Also see: TechCrunch “WordPress Security Issues Lead To Mass Hacking. Is Your Blog Next?“