Hacked Wordpress Command Line Tools

wordpress-cleaning-commands.sh

# Find suspicious php files
find . -type f -name '*.php' | xargs egrep -i "(mail|fsockopen|pfsockopen|stream\_socket\_client|exec|system|passthru|eval|base64_decode) *("

# Find suspicious images
find wp-content/uploads -type f -iname '*.jpg' | xargs grep -i php

#Find iframes
find . -type f -name '*.php'| grep -i '<iframe'

#Find files modified in last 3 days
find . -type f -name '*.php' -ctime -3

# Verify checksums of code and identify unexpected files
wp core verify-checksums
wp plugin verify-checksums --all

# WP-CLI Force refresh of all wordpress plugins and theme files
wp core download --force
wp plugin install $(wp plugin list --field=name) --force
wp theme install $(wp theme list --field=name) --force