Malicious content was found in the database

What Wordfence found

The scanner checked post content, options and other tables against its signatures and found a match. Typical cases are injected script tags across published posts, malicious redirects stored in options, or spam links inserted into content at scale.

Why it matters

Database injections survive a complete reinstall of WordPress core, plugins and themes, which is why sites are so often reinfected after a clean-looking file restore. They also serve malware directly to visitors, so the site can be blocklisted while the files look perfectly clean.

How to fix it

1. 1Identify the affected rows before changing anything — the finding names the table.
2. 2Restore the database from a backup predating the injection if you have one.
3. 3Otherwise clean the rows, but do it with a targeted query rather than a blind search-and-replace across the whole database.
4. 4Check wp_options for injected values as well as wp_posts — redirects usually live there.
5. 5Re-scan, and check the site in a browser as a logged-out visitor, since many injections only fire for anonymous traffic.

Findings that often appear with this one

• A malicious URL was found in a site option Malware
• The site is flagged by Google Safe Browsing Malware

How WPSecureOps treats it

The connector reports this as database. WPSecureOps files it under Malware and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.