wyhycu

Update: wordpress.com has removed/replaced the file, it appears. Support case still unaddressed but root problem is solved. No more mystery posts.

In case anyone else is struggling with random Russian casino posts appearing in your wordpress.com website, I found the culprit.

The instance has 2 folders. htdocs & a read-only wordpress folder with sample content with I cannot alter.

The text in the sample matches the spam posts. "./themes/organic-stax/1.4.6.1/demo/default-demo-content.xml: <content:encoded><![CDATA[Имеется множество формальностей, которые приходиться придер..." (see pastebin link for more)

I have shared this with wordpress support and they stopped replying to my emails. Now I have to check and delete any new posts every day.

Will update if wordpress.com finally addresses this.