After stopped and cleaned the WordPress pingback and trackback spams, those spammers have changed strategy to start spamming comments and trackbacks on the post attachments.

Solution

1.1 Stop commenting on new and existing attachment. Add below PHP script in theme’s function.php

${theme_folder}/function.php

//disable comments on attachment
function filter_media_comment_status( $open, $post_id ) {

    $post = get_post( $post_id );
    if( $post->post_type == 'attachment' ) {
        return false;
    }
    return $open;

}
add_filter('comments_open', 'filter_media_comment_status', 10 , 2 );

1.2 Update existing attachments, in wp_posts table, update post attachment ping_status and comment_status to closed

phpMyAdmin or MySQL consoles

UPDATE wp_posts SET ping_status='closed' WHERE post_type = 'attachment';

UPDATE wp_posts SET comment_status='closed' WHERE post_type = 'attachment';

1.3 Delete the existing comment spam. The attachment comments are indicated as trackback comments.


DELETE FROM  `wp_comments` WHERE  `comment_type` =  'trackback'
Note
WordPress should really consider turning off the pingback and trackback features by default, it is attracting many spammers and add less value to the WordPress platform. Btw, who is using trackback?

References

  1. How to Stop WordPress Pingbacks and Trackbacks Spam
  2. Wordpress Post Types