WP (v1.0.2) Connection Error - SyntaxError: JSON.parse

[r3dvorak]

Hello there,
I am trying to connect an up2date WP site and get a Connection error (APIApplicationIsBroken) with a 200 status.
When I call the /wp-json directly, I get a
SyntaxError: JSON.parse: unexpected character at line 1 column 1 of the JSON data

I hesitate to post this info publicly - but posting the 36k text on jsonlint.com I get this statement:

Invalid JSON!
Error: Parse error on line 1:
<script>function _0x
^
Expecting 'STRING', 'NUMBER', 'NULL', 'TRUE', 'FALSE', '{', '[', got 'undefined'

The HTTP HEADERS are

Date Fri, 10 Jan 2025 09:51:20 GMT
Server Apache
X-Robots-Tag noindex
X-Content-Type-Options nosniff
Access-Control-Expose-Headers X-WP-Total, X-WP-TotalPages, Link
Access-Control-Allow-Headers Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type
X-WP-Total 824
X-WP-TotalPages 83
Link https://www.***.de/wp-json/wp/v2/media?page=2; rel="next"
Allow GET
Vary Origin,Accept-Encoding,User-Agent
Upgrade h2,h2c
Connection Upgrade
Transfer-Encoding chunked
Content-Type application/json; charset=UTF-8

Obviously, something is wrong with this WP site, but I have no idea where to start - any Ideas?

Thank you,
Richard

[nikosdion]

The WordPress JSON API of your site is returning a script tag. Normally, I would say that this is a third party plugin doing something wrong.

However, from these very few bytes you have shared, it appears that you have a script which sets a function with a weird name starting with _0x. Last time I saw something like that, the site was hacked.

Try disabling all plugins except for the Panopticon connector plugin. If you get the same result, sorry, your site is hacked; you'll have to clean it first.

If the problem disappears, one of the plugins you are using is printing out a script tag before the WP-JSON response. Start enabling plugins one by one and visit the /wp-json URL on your site until you see the script tag; the latest plugin you enabled is the culprit.

[r3dvorak]

Yes, you are right: the site is hacked. So I'll need to do some serious cleaning first.
At least we know it is not Panopticon related :) ...

[nikosdion]

Sorry to have been the bearer of bad news 🙁