wpinfo-pst1 Obfuscated Redirect Stored in post_content

Summary

This WordPress malware research entry documents database-stored packed redirect script evidence observed during one anonymized client investigation. The narrow topic is wpinfo-pst1 Obfuscated Redirect Stored in post_content: the page records the exact artifact, identifiers, and visible control flow instead of repeating a general malware-removal article.

The artifact is consistent with a database-stored redirect or traffic-monetization loader. The incomplete destination string and absent browser trace prevent a stronger visitor-outcome claim.

Investigation context

Anonymized investigation with two database screenshots and a supplied packed JavaScript sample; one directly relevant image is published. The report date is retained from the original investigation notes. Broader cleanup guidance remains in the WordPress malware removal guide; this entry is limited to what the supplied code and screenshots support.

Observed artifact

The wpinfo-pst1 script was stored in post_content.

Confirmed findings

• The database screenshot shows wpinfo-pst1 in post_content.
• The script uses a packed eval(function(p,a,c,k,e,d)…) form.
• The decoded token list visibly includes document, write, script, src, navigator, and referrer.
• The supplied string constructs an external script source.

Technical analysis

Why wpinfo-pst1 is a useful database search key

The following code keeps the identifiers and control flow needed for defensive verification while removing secrets, complete payloads, and operational request instructions.

Redacted defensive excerpt

<script id="wpinfo-pst1">
  eval(function (p, a, c, k, e, d) {
    /* packed body redacted */
  });
</script>

This excerpt is intentionally incomplete. It should be used for code search, baseline comparison, and incident review—not copied into a live site.

Analyst assessment

The artifact is consistent with a database-stored redirect or traffic-monetization loader. The incomplete destination string and absent browser trace prevent a stronger visitor-outcome claim.

The severity reflects the capability visible in this artifact and its position in the investigated WordPress environment. It is not a claim about campaign prevalence, a particular vulnerability, or an outcome that the retained evidence does not show.

Indicators of compromise

Higher-confidence indicators

• wpinfo-pst1
• Packed token list containing document|javascript|write|script
• The identifier inside post_content

Contextual indicators

• eval(function(p,a,c,k,e,d)
• document.write()
• post_content
• External IP-based URL

Contextual indicators are not proof of infection by themselves. Confirm them through trusted-file comparison, neighboring code, database provenance, request logs, or the distinctive combinations listed above.

What this evidence does not establish

• The remote script response was not retained.
• The evidence does not identify the database write path.
• The second screenshot belongs to a different widget_block artifact and is not treated as the same chain.
• No campaign size or affected version was established.

Artifact-specific remediation

• Export the affected row and table before editing.
• Remove the script from confirmed records and search revisions, widgets, and options separately.
• Search the database for wpinfo-pst1 and distinctive packed tokens.
• Investigate the write path through logs and administrator activity if available.

For a complete response sequence, use the broader malware-removal guide or the WordPress malware-removal service when hands-on incident response is appropriate.

Recurrence verification

• Repeat the database search after scheduled events and content edits.
• Confirm rendered pages no longer contain wpinfo-pst1.
• Monitor affected records for unexpected modification.

Related malware research

Browse the WordPress malware research hub.

• ushort.company Meta-Refresh and JavaScript Redirect in post_content
• Database-Stored fetch() Calls Injecting Remote Spam Content
• c-i.icu Click-Triggered Redirect Script in index.php

Related guides and case studies

• WordPress database malware guide
• JavaScript redirect malware detection guide
• Hidden redirect removal case study

Methodology and privacy note

This analysis is based on retained code, screenshots, paths, and notes from an anonymized WordPress client investigation. Confirmed findings are limited to visible or supplied evidence; professional interpretation is labeled as analyst assessment. Screenshots were reviewed for client identifiers, account paths, usernames, email addresses, credentials, tokens, database details, and unrelated records. Sensitive or operational material remains outside the public page, and every public code block is a redacted defensive excerpt.