How do I batch delete rogue JS that infected the database in wordpress?

We will explain how to batch delete malformed JS that infected the database in WordPress.

Malicious code infecting the database

We may find JAVASCRIPT code that infects databases, such as plug-ins that can detect database malware.

In many cases, these malicious Javascripts are embedded in thousands of posts, and it is difficult to remove them one by one by hand. In this case, you can use a plugin to remove them one by one with regular expressions.

Bulk removal by pattern matching with regular expressions

A regular expression is a method to search for strings in a more meta way. For example, the following regular expression can match a string of 10 or more numbers.

/[0-9]{10,}/

If you create a regular expression that matches and replaces the aforementioned illegal JAVASCRIPT, and execute the regular expression on all posts, it is possible to remove the illegal JAVASCRIPT at once.

If you observe the malformed code carefully, you will see that it starts with 　<script>$mWn= and ends with </script> without < in between.

This regular expression can be expressed as follows

/<script>$mWn=[^<]*<\/script>/

The $ and / are backslash escapes because they are meaningful expressions in the regular expression.
The [^<]* means as long as the string is followed by a string that is not 　<.

*It is possible to create regular expressions by experimenting with them at this site. You can see that it matches within the correct range.

Regular expressions to remove malformed JS infecting WordPress databases

Next, we will use regular expressions to remove the malformed JS embedded in posts and other content.
If this removal process fails, important database information may be lost, so we recommend that you make a backup of your database before removal.

1 Install the Search Regex plugin that allows you to replace the database with regular expressions.

2 Go to Tools→Search Regex and perform the replacement process using regular expressions.
First, configure the regular expression as shown in the figure below, and check that it matches the invalid code properly as no operation.

Next, set the operation to replace the entire string, add a single space character to the replacement string, and execute the replacement.

This completes the bulk removal of the invalid JS.

Please note that removing malware from the database alone may not solve the problem!

The fact that malware has been embedded in the database means that hackers have already obtained the database search permissions through some vulnerability, and it is highly likely that other malware programs have been installed on the server.

It will be necessary to inspect for other malware and close the vulnerabilities that allowed the hacker to enter the database.