|
Are those links by chance encoded in base64? I believe there is an exploit in WordPress wp-register.php/wp-login.php that allowed someone to register and instantly have full admin access.
I had this issue with WP once, someone from China kept registering accounts on my blog via wp-register (WP settings to new registers was SUBSCRIBER, no admin access) and they were dumping base64 encoded javascript links into my HTML code templates that made links appear all over.
|