No longer able to access Wordpress admin panel

Question

I am no longer able to access the admin panel of a Wordpress site. 2 days ago I added a plugin, loaded some new content, and things were working fine. The client loaded some regular blog posts, and today, it no longer works.

First of all, the error itself:

I go to URL: mydomain.com/wp-admin, the browser redirects to: mydomain.com/wp-login.php?redirect_to=http%3A%2F%2Fmydomain.com%2Fwp-admin%2F&reauth=1

The error message says:

Not Found

The requested URL /mother/18/readf.php was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

What I know so far:

• Nothing in .htaccess redirects to mother/18/readf.php
• A search of similar errors gives a lot of results where urls within normal sites seem hijacked to sell antidepressants, viagra, etc. When I say normal sites I mean that there are sites that do logistics, https://www.google.com.ar/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=mother//readf.php&safe=off&nfpr=1&start=10 https://www.google.com.ar/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=mother//readf.php&safe=off&nfpr=1&start=10
• Disabling all plugins doesn't help (I renamed the plugins folder and then tried to log into the admin).
• Searching the database for readf.php or mother doesn't show anything obvious.
• The client claims to only have made changes to content since yesterday, when the site admin was still working. (Yes, claims... they have superadmin access, so this might not be true).

Has anyone come across this issue? Any ideas on what I can look for next?

Answer 1

Sounds like you got hacked. Time to fix it right the first time, or you will get hacked again. You need to replace all core WP files/folders (except wp-config.php and wp-content), but scan the uploads folder and theme for exploit code and modified files or added files, like readf.php. Replace all plugins, too.

Also scan the database for eval code and added administrators. (See "My Site was Hacked" below).

Change all host, FTP and WordPress passwords in the process. Scan your own PC for malware that might have grabbed logins and passwords.

Tell your web host you got hacked; and consider changing to a more secure host.

Carefully follow FAQ - My Site Was Hacked at WordPress.org.

Then take a look at the recommended security measures in Hardening WordPress and Brute Force Attacks at WordPress.org.