Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that is correctly marked as spam, but cannot be removed from the admin dashboard by clicking Empty Spam or manually selecting the entry and trying to delete it.

I looked into this and noticed that the DB entry has a comment_post_ID of 0, which I'd have to assume means it is not attached to any post. I can obviously remove them manual from the DB (and it works just fine), but haven't found any information on what this could be.

I've replaced the core WP files (thinking it might be a security issue) and also re-generated the salts/keys in the wp-config.php file without any change.

Any thoughts would be a huge help. thanks!

Update

While this may have stemmed from, I'm not sure if it is the result of the InMotion hack.

Here's what's been done:

• Changed FTP, MySQL passwords
• Created new DB user, assigned to database
• Updated salts/keys in wp-config.php
• Changed all WP user passwords
• Re-installed core WordPress files

Akismet is out of ideas on this one (don't blame them) as this one is persistent.

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that is correctly marked as spam, but cannot be removed from the admin dashboard by clicking Empty Spam or manually selecting the entry and trying to delete it.

I looked into this and noticed that the DB entry has a comment_post_ID of 0, which I'd have to assume means it is not attached to any post. I can obviously remove them manual from the DB (and it works just fine), but haven't found any information on what this could be.

I've replaced the core WP files (thinking it might be a security issue) and also re-generated the salts/keys in the wp-config.php file without any change.

Any thoughts would be a huge help. thanks!

Update

While this may have stemmed from, I'm not sure if it is the result of the InMotion hack.

Here's what's been done:

• Changed FTP, MySQL passwords
• Created new DB user, assigned to database
• Updated salts/keys in wp-config.php
• Changed all WP user passwords
• Re-installed core WordPress files

Akismet is out of ideas on this one (don't blame them) as this one is persistent.

• comments
• database
• security

Share Improve this question edited Nov 20, 2012 at 17:08 Zach asked Nov 7, 2012 at 17:10 ZachZach 1,95355 gold badges3232 silver badges5454 bronze badges 11

• 2 If a comment is posted without a post ID the ID is set to '0'. Look in /wp-comments-post.php. The next few lines should kill the script though, unless you have a post with ID '0'. And that is puzzling, which is why this is a comment and not an attempt at an answer. – s_ha_dum Commented Nov 7, 2012 at 17:37
• Yeah - this one's a head-scratcher for sure – Zach Commented Nov 7, 2012 at 19:53
• 1 Another idea. Grab the spammers IP from the DB and search for it in the server logs. Which url has the spammer requested? – Ralf912 Commented Nov 22, 2012 at 21:08
• 1 do a grep on comment_save_pre and see if there's a function that alters the data before it is saved. It's not possible to add a comment without an (open to comments) post number, so it has the be changed after reception. Some questions: Are there custom post types, do you use ajax to submit comments (plugins). Are you using captcha plugins. – Patriek Commented Nov 25, 2012 at 19:25
• 1 Hi all - appreciate the continued interest in this one. A few responses: No plugins that hook into either comment_id_not_found or comment_save_pre (did have a plugin called Easy Comment Uploads previously, but is unpublished and can't find original files - now using Comment Images). The access logs have yet to reveal any matches for these IP addresses (which also don't match), but searches confirm they are spam (if that wasn't obvious already ha). – Zach Commented Nov 26, 2012 at 14:45

 |  Show 6 more comments

1 Answer 1

Sorted by: Reset to default 1

I'm sorry can't comment here but i'll try to help.

wp_handle_comment_submission function handing comments posting contains exact check for post_id:

    $post = get_post( $comment_post_ID );

    if ( empty( $post->comment_status ) ) {
         ...
       return error_happened; 
    }

i.e. (1) it passes through , or (2) comment was added other than default way of posting comments.

For (1) - check that post with id=0 doesnt exists in db, wp_posts table. Sometimes failures in database cause presence of such records