I work at a company as a Communications specialist. I’m not even the web master or programming specialist. But I’m the one that uploads content and probably the one more “familiarized” to our website and how it works. That is because the company is small and only has enough budget for certain roles. Our webiste was developed by a web master some years ago. He also built an admin panel (intranet) for us to update content and articles. We hire him sometimes when we need to update something that is not on the intranet or fix a problem. Our site has been getting weird links in different sections (banners, articles, etc.) but before they were just links to replica watches sites which I could delete manually.

Today I found out there were tons of links about “escorts services” “escorts agencies” such as “capa escorts” “tuzla escorts” “sisili escorts” and similars. These I can still delete one by one but the fact that they’ve been spammed all over the site in different sections is worrying me alot, and of course also the fact that they have words linked to sexual stuff. When clicking them, they are all linked to sites that dipslay a banner saying “website under construction” It’s the same banner in all of them but with different URLs. Luckily, none of them have any real escort content besides the URL. I’m pressuring my boss to pay this guy to fix this issue. My boss (and those above him) didn’t want to waste basically any money this year because the company was on a budget. The guy offerred us to fix the problem for a certain cost, or to hire him monthly to fix constant issues like this.

Here’s a screenshot of some of the spam text

I’ve changed the hosting site password and cpanel many times (hosting and cpanel are on hostpapa), and also the admin panel-intranet password. But we still get this weird links. I’m assuming the webmaster has access to the sites hosting code from the intranet he built. So even if I changed password he would still be able to get into the code. I’m not saying he’s the hacker. But also the hackers may have gained access to the intranet and that’s how they are spamming this links across sections.

I can create and delete users from the intranet (admin panel) but I don’t know if the webmaster has permanent access from somewhere I can’t control.

How common is this? To get “hacked” by just with link spamming, modifying content that is on the admin-panel? Could it be the web master?

TLDR: Company website is being spammed with links, want to know if this is common when hacking sites or if it could be the webmaster who built the site and is looking for a “job” fixing the issue.

PS/Important update Edit: I forgot to mention all of these links appear only on sections that can be modified through the admin panel (the intranet that the webmaster built for us to update content), none of them are added by actually coding the site cpanel. I’m 100% sure no one else from our team has access to this panel. So it’s either hackers/bots/ or the webmaster who still has access to it.