After stopped and cleaned the WordPress pingback and trackback spams, those spammers have changed strategy to start spamming comments and trackbacks on the post attachments.

Solution

1.1 Stop commenting on new and existing attachment. Add below PHP script in theme’s function.php

//disable comments on attachment
function filter_media_comment_status( $open, $post_id ) {
    $post = get_post( $post_id );
    if( $post->post_type == 'attachment' ) {
        return false;
    return $open;
add_filter('comments_open', 'filter_media_comment_status', 10 , 2 );

1.2 Update existing attachments, in wp_posts table, update post attachment ping_status and comment_status to closed

UPDATE wp_posts SET ping_status='closed' WHERE post_type = 'attachment';
UPDATE wp_posts SET comment_status='closed' WHERE post_type = 'attachment';

1.3 Delete the existing comment spam. The attachment comments are indicated as trackback comments.

DELETE FROM  `wp_comments` WHERE  `comment_type` =  'trackback'

References

1. How to Stop WordPress Pingbacks and Trackbacks Spam
2. WordPress Post Types